faberun 0.27.0 → 0.29.0

package/src/contract/definition-of-done.mjs

@@ -1,4 +1,6 @@
 import { rejectUnknown, requireId, requireString } from "./assert.mjs";
+import { errorMessage, shellWords } from "../util.mjs";
+import { Script } from "node:vm";
 /**
  * Schema 2 Definition of Done items. Each item is an object that names an
  * observable outcome and declares how it is proven: mechanically through a
@@ -210,5 +212,167 @@ export function unquotedFilterValueWarnings(items, index) {
   return warnings;
 }
 
+/**
+ * The body of an inline `node -e`/`node --eval` script named by a command
+ * proof's shell command, or null when the command carries none. The proof runs
+ * through a shell, so the body is the next shell word with its quotes removed:
+ * `shellWords` expands and escapes nothing, which is also how the shell hands
+ * the body to node. `-e` belongs to other commands too (`grep -e` the common
+ * one), so a scan only starts at a token that names the node binary.
+ *
+ * @param {string} commandText
+ * @returns {string|null}
+ */
+export function inlineScriptBody(commandText) {
+  const tokens = shellWords(commandText);
+  for (let index = 0; index < tokens.length; index += 1) {
+    if (!isNodeExecutable(tokens[index])) continue;
+    for (let position = index + 1; position < tokens.length; position += 1) {
+      const token = tokens[position];
+      if (SHELL_SEPARATORS.has(token)) break;
+      if (token === "-e" || token === "--eval") {
+        const body = tokens[position + 1];
+        return body === undefined || SHELL_SEPARATORS.has(body) ? null : body;
+      }
+      if (token.startsWith("--eval=")) return token.slice("--eval=".length);
+      if (token.startsWith("-e=")) return token.slice("-e=".length);
+    }
+  }
+  return null;
+}
+
+/**
+ * The syntax error a `node -e`/`node --eval` body names, or null when the
+ * command is not an inline script or its body parses. `vm.Script` is node's
+ * own grammar for `-e`; the two shapes node's module wrapper accepts but a
+ * classic script does not -- top-level `await` and static ESM syntax -- are
+ * re-tried or allowed rather than refused, so a valid proof is never refused
+ * for a body this check cannot parse. A genuine error in the tail of an
+ * awaited body still surfaces through the async re-try.
+ *
+ * @param {string} commandText
+ * @returns {string|null}
+ */
+export function inlineScriptParseError(commandText) {
+  const body = inlineScriptBody(commandText);
+  return body === null ? null : scriptSyntaxError(body);
+}
+
+/**
+ * Refuse a contract whose command proof is an inline script that does not
+ * parse, naming the node and the Definition of Done item. The launch calls
+ * this before the first dispatch: a body the parser rejects can never exit 0,
+ * so every attempt would be spent on work no delivery could satisfy.
+ *
+ * @param {{id?: unknown, definitionOfDone?: {id?: unknown, proof?: {kind?: unknown, ref?: unknown}}[]}[]} nodes
+ * @returns {void}
+ */
+export function assertInlineScriptProofsParse(nodes) {
+  for (const node of nodes) {
+    for (const item of node.definitionOfDone ?? []) {
+      if (item.proof?.kind !== "command" || typeof item.proof.ref !== "string") continue;
+      const parseError = inlineScriptParseError(item.proof.ref);
+      if (parseError === null) continue;
+      const nodeName = node.id === undefined ? "a node" : `node ${node.id}`;
+      throw new TypeError(`${nodeName}, Definition of Done item "${item.id}": the proof command's inline script does not parse: ${parseError}`);
+    }
+  }
+}
+
+/**
+ * The quote a command proof's text leaves open, or null when every quote it
+ * opens is closed. `kind: "command"` goes through `/bin/sh -c`, so a text with
+ * an odd number of `'` or `"` is refused by the shell before the command runs,
+ * with `unexpected EOF while looking for matching`. Measured 2026-09-27 (AP13
+ * of safe-to-hand-to-friend): the freeze accepted
+ * `node --test --test-name-pattern=a stranger's first campaign completes
+ * offline test/…` — an apostrophe inside an unquoted test title — the node did
+ * the work and passed its own test in 15 s, and both attempts were spent on a
+ * command `/bin/sh` never ran.
+ *
+ * This is a quote scanner, not a shell parser: it reports the two failures a
+ * proof can carry without expanding anything (an open quote, or nothing at
+ * all), and leaves every other shell construct to the shell. A `$'…'` string
+ * and a quote inside a here-document are the constructs it does not model.
+ *
+ * @param {string} commandText
+ * @returns {string|null}
+ */
+export function unclosedQuote(commandText) {
+  /** @type {string|null} */
+  let quote = null;
+  let escaped = false;
+  for (const character of commandText) {
+    if (escaped) { escaped = false; continue; }
+    // Outside double quotes a backslash escapes the next character; a
+    // backslash inside single quotes is literal, which POSIX also gives it.
+    if (quote !== "'" && character === "\\") { escaped = true; continue; }
+    if (quote === null && (character === "'" || character === '"')) { quote = character; continue; }
+    if (quote === character) quote = null;
+  }
+  return quote;
+}
+
+/**
+ * Refuse a contract whose command proof the shell cannot parse, naming the
+ * node, the item and the open quote. The freeze and the launch both call it:
+ * a command no attempt can run is the same waste as an inline script that
+ * cannot parse, and cheaper to refuse than to discover.
+ *
+ * @param {{id?: unknown, definitionOfDone?: {id?: unknown, proof?: {kind?: unknown, ref?: unknown}}[]}[]} nodes
+ * @returns {void}
+ */
+export function assertProofCommandsParse(nodes) {
+  for (const node of nodes) {
+    for (const item of node.definitionOfDone ?? []) {
+      if (item.proof?.kind !== "command" || typeof item.proof.ref !== "string") continue;
+      const quote = unclosedQuote(item.proof.ref);
+      if (quote === null) continue;
+      const nodeName = node.id === undefined ? "a node" : `node ${node.id}`;
+      throw new TypeError(`${nodeName}, Definition of Done item "${item.id}": the proof command leaves a ${quote} open, so /bin/sh refuses it before it runs ("unexpected EOF while looking for matching \`${quote}'"). Quote the value, as in --test-name-pattern="<title>".`);
+    }
+  }
+}
+
+/** @param {string} token @returns {boolean} */
+function isNodeExecutable(token) {
+  const base = (token.split(/[\\/]/u).pop() ?? token).toLowerCase();
+  return base === "node" || base === "nodejs" || base === "node.exe";
+}
+
+/**
+ * @param {string} body
+ * @returns {string|null}
+ */
+function scriptSyntaxError(body) {
+  try {
+    void new Script(body);
+    return null;
+  } catch (error) {
+    const message = errorMessage(error);
+    if (AWAIT_OUTSIDE_ASYNC.test(message)) {
+      try {
+        // The rest of the body still has to parse, so an unparsable tail is
+        // refused even when the head needed the async wrapper to parse at all.
+        void new Script(`(async () => {\n${body}\n})`);
+        return null;
+      } catch (wrapped) {
+        const wrappedMessage = errorMessage(wrapped);
+        return MODULE_SYNTAX.test(wrappedMessage) ? null : wrappedMessage;
+      }
+    }
+    // node's `-e` accepts static imports, exports and `import.meta`; no stable
+    // API parses a module here, so a module-only diagnostic is not a syntax
+    // error this check can prove and the body is allowed.
+    return MODULE_SYNTAX.test(message) ? null : message;
+  }
+}
+
+/** vm.Script's diagnostics for syntax node's `-e` module wrapper accepts. */
+const AWAIT_OUTSIDE_ASYNC = /await is only valid in async functions|^Unexpected reserved word$/u;
+const MODULE_SYNTAX = /Cannot use import statement outside a module|Cannot use 'import\.meta' outside a module|Unexpected token 'export'/u;
+/** Shell tokens that end one command, so a later `-e` is not this node's. */
+const SHELL_SEPARATORS = new Set(["&&", "||", "|", ";", "&", ">", ">>", "<"]);
+
 /** The node:test filter flags a `kind: "command"` proof's shell can split on an unquoted value. */
 const TEST_FILTER_FLAGS = ["--test-name-pattern", "--test-skip-pattern"];

package/src/contract/index.mjs

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { readFileSync, statSync } from "node:fs";
 import { dirname, resolve } from "node:path";
-import { loadTaskPacket, renderWorkerPrompt } from "./task-packet.mjs";
+import { loadTaskPacket, renderWorkerPrompt, validateEnvPassthrough } from "./task-packet.mjs";
 import { RESERVED_ARTICLES } from "./articles.mjs";
 import { judgmentReasonWarnings, unquotedFilterValueWarnings, validateDefinitionOfDone } from "./definition-of-done.mjs";
 import { validateFinalVerification, validateSharedVerification } from "./final-verification.mjs";
@@ -37,7 +37,7 @@ const CONTRACT_FIELDS = new Set([
   "schemaVersion", "contractVersion", "id", "campaignId", "goal", "cwd", "sourceIdentity",
   "maxParallel", "pollIntervalMs", "stallTimeoutSec", "timeoutSec", "maxTurns", "phaseSessionReuse",
   "runtimeDefaults", "runtimes", "nodes", "warnings", "finalVerification", "sharedVerification", "nodeAdvisory", "judges",
-  "judgeIndependence",
+  "judgeIndependence", "envPassthrough",
 ]);
 const DEFAULTS_FIELDS = new Set(["worker", "judge"]);
 const NODE_FIELDS = new Set([
@@ -68,13 +68,13 @@ const GATE_REVIEWS = new Set(["none", "advisory", "blocking"]);
 
 /** @typedef {{mode: "execution"|"discovery"|"autonomous", objective: string, instructions: string[], readFiles: string[], writeFiles?: string[], writeRoots?: string[], symbols: string[], scopeAcknowledged?: string[], decisions: string[], nonGoals: string[], verification: VerificationCommand[]}} TaskPacket */
 
-/** @typedef {{harness: "claude"|"codex"|"agy"|"dsh"|"fx"|"zcode"|"exec-jsonl"|"replay", model: string, reasoning?: string, sandbox?: "read-only"|"workspace-write"|"danger-full-access", permissionMode?: string, config?: Record<string, unknown>, printTimeout?: string, tools?: string[], executable?: string, args?: string[], versionArgs?: string[], maxArgvPromptBytes?: number, requiredCapabilities?: CapabilityRequirements, costRank?: number, fallback?: string, vendor: string, tier?: number|string, stallTimeoutSec?: number, maxConcurrent?: number}} ValidatedRuntime */
+/** @typedef {{harness: "claude"|"codex"|"agy"|"dsh"|"fx"|"zcode"|"exec-jsonl"|"replay", model: string, reasoning?: string, sandbox?: "read-only"|"workspace-write"|"danger-full-access", permissionMode?: string, config?: Record<string, unknown>, printTimeout?: string, tools?: string[], executable?: string, args?: string[], versionArgs?: string[], maxArgvPromptBytes?: number, requiredCapabilities?: CapabilityRequirements, costRank?: number, fallback?: string, vendor: string, tier?: number|string, stallTimeoutSec?: number, maxConcurrent?: number, envPassthrough?: string[]}} ValidatedRuntime */
 
 /** @typedef {{enabled: boolean, review?: ("none"|"advisory"|"blocking"), runtime?: string, failOn?: ("minor"|"major"|"critical")[], maxRevisions?: number, requiredCapabilities?: CapabilityRequirements, skipWhen?: {verificationGreen: true, maxChangedPaths: number}}} ValidatedGate */
 
 /** @typedef {{id: string, type: string, phase: string, requirementIds?: string[], runtime?: string, dependsOn: string[], taskPacket: TaskPacket, taskPacketFile?: string, prompt: string, definitionOfDone: import("./definition-of-done.mjs").DefinitionOfDoneItem[], gate: ValidatedGate, timeoutSec?: number, maxTurns?: number, requiredCapabilities: CapabilityRequirements, packetHash: string, sourceIdentity: SourceIdentity, replayPolicy: "safe"|"reconcile"|"never", sameProviderReview: boolean, humanStep?: {step: string, command: string}}} ValidatedNode */
 
-/** @typedef {{schemaVersion: number, contractVersion: string, id: string, campaignId: string, goal: string, cwd: string, sourceIdentity: SourceIdentity, runtimes: Record<string, ValidatedRuntime>, runtimeDefaults: {worker?: string, judge?: string}, judges?: string[], judgeIndependence?: "same-vendor", nodes: ValidatedNode[], maxParallel: number, pollIntervalMs: number, stallTimeoutSec: number, timeoutSec: number, maxTurns: number, phaseSessionReuse: boolean, finalVerification?: VerificationCommand[], sharedVerification?: VerificationCommand[], nodeAdvisory?: NodeAdvisoryPolicy, warnings: string[]}} ValidatedContract */
+/** @typedef {{schemaVersion: number, contractVersion: string, id: string, campaignId: string, goal: string, cwd: string, sourceIdentity: SourceIdentity, runtimes: Record<string, ValidatedRuntime>, runtimeDefaults: {worker?: string, judge?: string}, judges?: string[], judgeIndependence?: "same-vendor", nodes: ValidatedNode[], maxParallel: number, pollIntervalMs: number, stallTimeoutSec: number, timeoutSec: number, maxTurns: number, phaseSessionReuse: boolean, finalVerification?: VerificationCommand[], sharedVerification?: VerificationCommand[], nodeAdvisory?: NodeAdvisoryPolicy, envPassthrough?: string[], warnings: string[]}} ValidatedContract */
 /** @typedef {{costUsd?: number, durationSec?: number}} NodeAdvisoryPolicy */
 
 /** @typedef {"pending"|"running"|"done"|"no-op"|"blocked"|"failed"|"exhausted"|"stalled"|"canceled"} NodeStatus */
@@ -134,6 +134,9 @@ export function validateContract(raw, contractPath, options = {}) {
   requireId(raw.id, "contract.id");
   requireId(raw.campaignId, "contract.campaignId");
   requireString(raw.goal, "contract.goal");
+  // The contract-wide passthrough, unioned with each runtime's own at spawn
+  // time. Absent keeps every contract authored before the field valid.
+  if (raw.envPassthrough !== undefined) validateEnvPassthrough(raw.envPassthrough, "contract.envPassthrough");
 
   const contractDir = dirname(resolve(contractPath));
   const cwd = resolve(contractDir, typeof raw.cwd === "string" ? raw.cwd : ".");
@@ -150,7 +153,7 @@ export function validateContract(raw, contractPath, options = {}) {
     throw new TypeError("contract.runtimes must be an object");
   }
   const runtimes = /** @type {Record<string, ValidatedRuntime>} */ ({});
-  for (const [id, runtime] of Object.entries(rawRuntimes)) runtimes[id] = validateRuntime(id, runtime);
+  for (const [id, runtime] of Object.entries(rawRuntimes)) runtimes[id] = validateRuntime(id, runtime, { persisted });
   // A runtime's fallback is validated against sibling runtimes once every
   // runtime is known, so declaration order never matters.
   for (const [id, runtime] of Object.entries(runtimes)) {

package/src/contract/judge-independence.mjs

@@ -25,6 +25,24 @@ export function validateJudgeIndependence(value, label) {
   return value;
 }
 
+/**
+ * The `judgeIndependence` in force for a launch (R36): the contract's own
+ * declaration wins, and a contract that declares none inherits the machine
+ * config's opt-in. Both sources are already validated to the single accepted
+ * value before they reach here -- the contract by `validateJudgeIndependence`,
+ * the config by `isUserConfig` -- so this is a plain precedence read, not a
+ * second validation. A value neither source names (or a malformed raw config a
+ * test hands in) reads as no opt-in, exactly as an absent field would.
+ *
+ * @param {{judgeIndependence?: string}|null|undefined} contract
+ * @param {{judgeIndependence?: string}|null|undefined} config
+ * @returns {"same-vendor"|undefined}
+ */
+export function effectiveJudgeIndependence(contract, config) {
+  const mode = contract?.judgeIndependence ?? config?.judgeIndependence;
+  return mode === SAME_VENDOR_REVIEW_MODE ? SAME_VENDOR_REVIEW_MODE : undefined;
+}
+
 /**
  * Same-vendor mode's own admissibility rule for a worker/judge pair that
  * share a vendor: a judge model absent from the declared tier table can never

package/src/contract/runtime.mjs

@@ -10,6 +10,7 @@
  * validator to reach it.
  */
 import { assertObject, nonNegativeNumber, positiveInteger, positiveNumber, rejectUnknown, requireId, requireString, requireStringArray, requireTimestamp } from "./assert.mjs";
+import { validateEnvPassthrough } from "./task-packet.mjs";
 import { composeAssignments } from "../engine/runtime-discovery.mjs";
 import { harnessCapabilities, readOnlyModeOf, resolvePermissionExecution, resolveVendor, validateCapabilityRequirements, writesWorkspace } from "../harnesses/index.mjs";
 import { canonicalProvider } from "./provider.mjs";
@@ -25,7 +26,7 @@ import { stableJson } from "../util.mjs";
 const RUNTIME_FIELDS = new Set([
   "harness", "model", "reasoning", "sandbox", "permissionMode", "config", "printTimeout", "tools",
   "executable", "args", "versionArgs", "maxArgvPromptBytes", "requiredCapabilities", "costRank",
-  "fallback", "vendor", "tier", "pricing", "stallTimeoutSec", "maxConcurrent",
+  "fallback", "vendor", "tier", "pricing", "stallTimeoutSec", "maxConcurrent", "envPassthrough",
 ]);
 const RUNTIME_HARNESSES = new Set(["claude", "codex", "agy", "dsh", "fx", "zcode", "exec-jsonl", "replay"]);
 
@@ -92,9 +93,11 @@ export function routeRuntime(contract, node, role = "worker", event = {}) {
 /**
  * @param {string} id
  * @param {unknown} runtime
+ * @param {{persisted?: boolean}} [options] `persisted` is a replay of a contract
+ *   already accepted at launch; see the vendor rule below.
  * @returns {ValidatedRuntime}
  */
-export function validateRuntime(id, runtime) {
+export function validateRuntime(id, runtime, options = {}) {
   requireId(id, `runtime ${id}`);
   assertObject(runtime, `runtime ${id}`);
   rejectUnknown(runtime, RUNTIME_FIELDS, `runtime ${id}`);
@@ -102,16 +105,24 @@ export function validateRuntime(id, runtime) {
   const typedRuntime = /** @type {{harness: string, model: string, vendor?: string, config?: Record<string, unknown>}} */ (runtime);
   // The canonical provider derived from the route, the model's family, or the
   // harness default outranks a declared `vendor`: a label that contradicts it
-  // is refused (R18), and the runtime's vendor becomes the derived provider
-  // rather than whatever text the contract declared. `replay` and `exec-jsonl`
-  // derive none — for those the declared vendor stands, as it always has.
+  // is refused (R18) at authoring, and the runtime's vendor becomes the derived
+  // provider rather than whatever text the contract declared. `replay` and
+  // `exec-jsonl` derive none — for those the declared vendor stands, as it
+  // always has. A persisted load takes the derived provider without refusing,
+  // so a run launched before R18 stays readable and cancelable.
   const derived = canonicalProvider(typedRuntime);
   const declared = typeof typedRuntime.vendor === "string" && typedRuntime.vendor.length ? typedRuntime.vendor : undefined;
   let vendor;
   if (derived) {
-    if (declared !== undefined && declared !== derived) {
+    if (declared !== undefined && declared !== derived && options.persisted !== true) {
       throw new TypeError(`runtime ${id} declares vendor ${declared} but ${typedRuntime.harness} ${typedRuntime.model} is provider ${derived}`);
     }
+    // A replay canonicalizes a contradicting label instead of refusing it.
+    // Measured 2026-09-27 (AP6): three runs launched before R18 carried
+    // `vendor: anthropic-sonnet` against the model claude-sonnet-5, and every
+    // reader of their persisted contract — `cancel`, `status`, `report` — threw
+    // on a rule those contracts predate, leaving the runs unsuspended forever.
+    // The rule still refuses the label where it can be acted on: at authoring.
     vendor = derived;
   } else {
     vendor = resolveVendor(typedRuntime);
@@ -150,6 +161,9 @@ function validateRuntimeValues(runtime, label, executableRequired) {
   if (runtime.args !== undefined) requireStringArray(runtime.args, `${label}.args`);
   if (runtime.versionArgs !== undefined) requireStringArray(runtime.versionArgs, `${label}.versionArgs`);
   if (runtime.maxArgvPromptBytes !== undefined) positiveInteger(runtime.maxArgvPromptBytes, `${label}.maxArgvPromptBytes`);
+  // Names only, on the runtime descriptor directly or on the contract: either
+  // one asks the worker allowlist to carry the variable through by name.
+  if (runtime.envPassthrough !== undefined) validateEnvPassthrough(runtime.envPassthrough, `${label}.envPassthrough`);
   if (runtime.costRank !== undefined) nonNegativeNumber(runtime.costRank, `${label}.costRank`);
   if (runtime.stallTimeoutSec !== undefined) positiveNumber(runtime.stallTimeoutSec, `${label}.stallTimeoutSec`);
   if (runtime.pricing !== undefined) validatePricing(runtime.pricing, `${label}.pricing`);

package/src/contract/scope-findings.mjs

@@ -87,3 +87,123 @@ export function verificationFailureWithScope(verdict, scope) {
     }],
   };
 }
+
+/** The additions a reauthor discovery pass may propose to a refused packet. */
+/** @typedef {{readFiles?: string[], writeFiles?: string[], scopeAcknowledged?: string[], symbols?: string[]}} ReauthorAdditions */
+
+/** The bounded journal record a reauthor attempt leaves behind. */
+export const MAX_REAUTHOR_PATHS = 64;
+
+/**
+ * A widened packet may not take over a write another node's packet already
+ * owns. `validateContract` catches a packet that does not close its own scope
+ * and a pair whose test one node cannot touch, but two nodes declaring the
+ * same write are each individually closed, so no per-packet check sees the
+ * collision. This names the owner the discovery pass must leave alone.
+ *
+ * @param {import("../contract/index.mjs").ValidatedNode[]} nodes every node of the contract
+ * @param {string} nodeId the node being widened
+ * @param {string[]|undefined} addedWriteFiles the writes the discovery pass proposes to add
+ * @returns {{path: string, nodeId: string, reason: string}[]}
+ */
+export function reauthorWriteConflicts(nodes, nodeId, addedWriteFiles) {
+  const added = new Set(addedWriteFiles ?? []);
+  if (added.size === 0) return [];
+  /** @type {{path: string, nodeId: string, reason: string}[]} */
+  const conflicts = [];
+  for (const node of nodes) {
+    if (node.id === nodeId) continue;
+    for (const path of node.taskPacket.writeFiles ?? []) {
+      if (!added.has(path)) continue;
+      conflicts.push({
+        path,
+        nodeId: node.id,
+        reason: `${path} is already declared in writeFiles by node ${node.id}; a widened packet may not take over another node's write`,
+      });
+    }
+  }
+  return conflicts;
+}
+
+/**
+ * The bounded journal record a reauthor attempt leaves: the widened packet the
+ * discovery pass proposed (`reauthorProposal`) and the hard budget it spent
+ * (`reauthorRounds`). It lives in `reauthor.jsonl` beside the run's events
+ * rather than on the node snapshot, so a proposal never moves the authored
+ * packet hash or asks the snapshot schema to carry a transient shape.
+ *
+ * @param {{
+ *   nodeId: string,
+ *   outcome: "applied"|"approval_required"|"rounds_exhausted",
+ *   riskTier: string,
+ *   budget: number,
+ *   roundsUsed: number,
+ *   additions: ReauthorAdditions|null|undefined,
+ *   packet: import("./task-packet.mjs").TaskPacket|null|undefined,
+ *   findings: string[]|null|undefined,
+ *   history: {round: number, accepted: boolean, additions?: ReauthorAdditions, findings?: string[]}[],
+ * }} entry
+ * @returns {Record<string, unknown>}
+ */
+export function reauthorProposalRecord({ nodeId, outcome, riskTier, budget, roundsUsed, additions, packet, findings, history }) {
+  /** @param {string[]|undefined} paths @returns {string[]} */
+  const bounded = (paths) => [...new Set(paths ?? [])].slice(0, MAX_REAUTHOR_PATHS);
+  return {
+    at: new Date().toISOString(),
+    node: nodeId,
+    outcome,
+    riskTier,
+    reauthorProposal: {
+      packet: packet ?? null,
+      addedReadFiles: bounded(additions?.readFiles),
+      addedWriteFiles: bounded(additions?.writeFiles),
+      addedScopeAcknowledged: bounded(additions?.scopeAcknowledged),
+      findings: (findings ?? []).slice(0, 8),
+    },
+    reauthorRounds: {
+      budget,
+      used: roundsUsed,
+      exhausted: outcome === "rounds_exhausted",
+      history: history.map((item) => ({
+        round: item.round,
+        accepted: item.accepted,
+        addedReadFiles: bounded(item.additions?.readFiles),
+        addedWriteFiles: bounded(item.additions?.writeFiles),
+        findings: (item.findings ?? []).slice(0, 8),
+      })),
+    },
+  };
+}
+
+/**
+ * The risk tier a frozen node's gate encodes: a disabled gate is low risk, a
+ * blocking review is high, an advisory review is standard. A contract does not
+ * carry the plan's own riskTier, so the gate it froze into is the durable
+ * statement of how much a widening of its packet is trusted.
+ *
+ * @param {import("../contract/index.mjs").ValidatedNode} node
+ * @returns {"low"|"standard"|"high"}
+ */
+export function reauthorRiskTier(node) {
+  if (!node.gate.enabled) return "low";
+  return node.gate.review === "blocking" ? "high" : "standard";
+}
+
+/**
+ * Whether a validated widening may be applied without an explicit operator
+ * yes. Mirrors the planning pipeline's `--approve-below`: `high` approves
+ * everything, `none` approves nothing, and the default `standard` approves
+ * everything but a high-risk node. `approve` overrides the threshold.
+ *
+ * @param {import("../contract/index.mjs").ValidatedNode} node
+ * @param {{approve?: boolean, approveBelow?: string}} [options]
+ * @returns {boolean}
+ */
+export function reauthorApproved(node, options = {}) {
+  if (options.approve === true) return true;
+  const approveBelow = options.approveBelow ?? "standard";
+  if (approveBelow === "high") return true;
+  if (approveBelow === "none") return false;
+  if (approveBelow !== "standard") throw new TypeError(`approveBelow must be one of standard, high, none: ${approveBelow}`);
+  return reauthorRiskTier(node) !== "high";
+}

package/src/contract/snapshot.mjs

@@ -11,6 +11,7 @@
 import { Buffer } from "node:buffer";
 import { MAX_SCOPE_FINDING_PATHS } from "./scope-findings.mjs";
 import { REVIEW_MODES } from "./review-modes.mjs";
+import { SAME_VENDOR_REVIEW_MODE } from "./judge-independence.mjs";
 import { assertObject, boundedString, nonNegativeInteger, nonNegativeNumber, positiveInteger, positiveNumber, rejectUnknown, requireId, requireInteger, requirePacketHash, requireString, requireTimestamp } from "./assert.mjs";
 import { stableJson } from "../util.mjs";
 import { isAbsolute } from "node:path";
@@ -26,11 +27,17 @@ import { validateWorkerResult } from "./worker-result.mjs";
 /** @typedef {import("./index.mjs").RunMetadata} RunMetadata */
 /** @typedef {import("./index.mjs").ValidatedNode} ValidatedNode */
 
+/** Hard byte ceiling for an operator's answer text, enforced where it is accepted. */
+export const OPERATOR_ANSWER_MAX_BYTES = 8 * 1024;
+
+/** Hard ceiling for the failure evidence of a `Previous attempt` section, in bytes. */
+export const PREVIOUS_ATTEMPT_EVIDENCE_MAX_BYTES = 8 * 1024;
+
 /**
- * Hard byte ceiling for an operator's answer text, matching the bounded
- * `Previous attempt` section a retry in place already enforces (retry.mjs).
+ * The whole persisted `Previous attempt` section: the bounded evidence, then
+ * the operator's answer carried whole under its heading (engine/retry.mjs).
  */
-export const OPERATOR_ANSWER_MAX_BYTES = 8 * 1024;
+const PREVIOUS_ATTEMPT_MAX_BYTES = PREVIOUS_ATTEMPT_EVIDENCE_MAX_BYTES + OPERATOR_ANSWER_MAX_BYTES + 64;
 
 const GATE_VERDICTS = new Set(["pass", "fail", "invalid_judge_output"]);
 const NODE_STATUSES = new Set(["pending", "running", "done", "no-op", "blocked", "failed", "exhausted", "stalled", "canceled"]);
@@ -203,7 +210,7 @@ export function validateNodeSnapshot(value, expectedNode = null) {
     if (typeof value.previousAttempt !== "string" || !value.previousAttempt.trim()) {
       throw new TypeError("node snapshot.previousAttempt must be a non-empty string");
     }
-    if (Buffer.byteLength(value.previousAttempt, "utf8") > 8 * 1024) throw new TypeError("node snapshot.previousAttempt exceeds 8192 bytes");
+    if (Buffer.byteLength(value.previousAttempt, "utf8") > PREVIOUS_ATTEMPT_MAX_BYTES) throw new TypeError(`node snapshot.previousAttempt exceeds ${PREVIOUS_ATTEMPT_MAX_BYTES} bytes`);
   }
   if (expectedNode) validateSnapshotBinding(value, expectedNode);
   if (Buffer.byteLength(JSON.stringify(value), "utf8") > 128 * 1024) throw new TypeError("node snapshot exceeds 131072 bytes");
@@ -508,12 +515,19 @@ function validateRoutingState(value, label) {
   if (value.judgeList !== undefined) validateJudgeListState(value.judgeList, `${label}.judgeList`);
   if (value.assignments !== undefined) {
     assertObject(value.assignments, `${label}.assignments`);
-    rejectUnknown(value.assignments, new Set(["worker", "judge", "composedWorker", "composedJudge"]), `${label}.assignments`);
+    rejectUnknown(value.assignments, new Set(["worker", "judge", "composedWorker", "composedJudge", "judgeIndependence"]), `${label}.assignments`);
     requireId(value.assignments.worker, `${label}.assignments.worker`);
     requireId(value.assignments.judge, `${label}.assignments.judge`);
     for (const key of ["composedWorker", "composedJudge"]) {
       if (value.assignments[key] !== undefined && typeof value.assignments[key] !== "boolean") throw new TypeError(`${label}.assignments.${key} must be boolean`);
     }
+    // R36: the effective judge-independence mode the launch composed under,
+    // recorded so a resume, brief or report reads the decision back. Only the
+    // one accepted mode may be persisted; its absence is the cross-vendor
+    // default.
+    if (value.assignments.judgeIndependence !== undefined && value.assignments.judgeIndependence !== SAME_VENDOR_REVIEW_MODE) {
+      throw new TypeError(`${label}.assignments.judgeIndependence must be "${SAME_VENDOR_REVIEW_MODE}"`);
+    }
   }
   if (value.availability !== undefined) {
     assertObject(value.availability, `${label}.availability`);

package/src/contract/task-packet.mjs

@@ -2,6 +2,7 @@ import { existsSync, lstatSync, readFileSync, realpathSync, statSync } from "nod
 import { Buffer } from "node:buffer";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { validateVerificationCommands } from "./verification.mjs";
+import { RESERVED_OWNER_DECISIONS, uncoveredReservedOwnerDecisions } from "./articles.mjs";
 import { errorCode } from "../util.mjs";
 import { requireString, requireStringArray } from "./assert.mjs";
 
@@ -101,6 +102,25 @@ export function loadTaskPacket(node, contractDir, cwd, index, options = {}) {
   return validateTaskPacket(packet, index, cwd, options);
 }
 
+/**
+ * The `## Reserved owner decisions` section every worker prompt carries: the
+ * same list the judge reads, with the packet's own coverage spelled out, so an
+ * uncovered owner decision is refused with `blocked_context` instead of being
+ * chosen by a worker.
+ *
+ * @param {string[]} decisions
+ * @returns {string[]}
+ */
+function reservedOwnerDecisionsLines(decisions) {
+  const uncovered = uncoveredReservedOwnerDecisions(decisions);
+  return [
+    "## Reserved owner decisions",
+    `These decisions belong to the repository owner, never to this node: ${RESERVED_OWNER_DECISIONS.join(", ")}.`,
+    `Reserved decisions with no coverage in "Decisions already made": ${uncovered.length ? uncovered.join(", ") : "(none)"}.`,
+    "If the task requires taking an uncovered decision, do not choose it: return the blocked_context worker-result object naming the decision.",
+  ];
+}
+
 /**
  * @param {TaskPacket} packet
  * @param {string} nodeId
@@ -133,6 +153,8 @@ export function renderWorkerPrompt(packet, nodeId) {
     "## Decisions already made",
     ...bulletOrNone(packet.decisions),
     "",
+    ...reservedOwnerDecisionsLines(packet.decisions),
+    "",
     "## Non-goals",
     ...bulletOrNone(packet.nonGoals),
     "",
@@ -266,6 +288,28 @@ export function validateTaskPacket(packet, index, cwd, options = {}) {
   };
 }
 
+/**
+ * The environment-variable names an operator allows through to a worker, the
+ * one validator both the runtime descriptor and the contract share. The list
+ * is names only -- never values -- so it selects from the controller's own
+ * environment without carrying a secret of its own. A name is the portable
+ * shell shape: a letter or underscore, then letters, digits, or underscores.
+ *
+ * @param {unknown} value
+ * @param {string} label
+ * @returns {string[]}
+ */
+export function validateEnvPassthrough(value, label) {
+  if (!Array.isArray(value)) throw new TypeError(`${label} must be an array of environment-variable names`);
+  const names = /** @type {unknown[]} */ (value);
+  names.forEach((name, index) => {
+    if (typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/u.test(name)) {
+      throw new TypeError(`${label}[${index}] must be an environment-variable name`);
+    }
+  });
+  return /** @type {string[]} */ (names);
+}
+
 /**
  * @param {string} path
  * @param {string} label
@@ -456,6 +500,8 @@ function renderDiscoveryPrompt(packet, nodeId) {
     "## Decisions already made",
     ...bulletOrNone(packet.decisions),
     "",
+    ...reservedOwnerDecisionsLines(packet.decisions),
+    "",
     "## Non-goals",
     ...bulletOrNone(packet.nonGoals),
     "",
@@ -484,7 +530,7 @@ function renderAutonomousPrompt(packet, nodeId) {
     packet.objective,
     "",
     "## Closed context",
-    "This autonomous context may inspect the repository read-only as needed. Edit only files beneath the listed write roots, and do not write outside those directory boundaries. If required context is unavailable, return the blocked_context worker-result object below.",
+    "This autonomous context may inspect the repository read-only as needed. The write roots below are the expected boundary, not a hard wall: a write outside them is allowed when the task requires it, and the result must name the path and the reason. Return the blocked_context worker-result object below only for context that is genuinely missing.",
     "",
     "## Instructions",
     ...numbered(packet.instructions),
@@ -501,6 +547,8 @@ function renderAutonomousPrompt(packet, nodeId) {
     "## Decisions already made",
     ...bulletOrNone(packet.decisions),
     "",
+    ...reservedOwnerDecisionsLines(packet.decisions),
+    "",
     "## Non-goals",
     ...bulletOrNone(packet.nonGoals),
     "",