faberun 0.3.0 → 0.6.0

package/src/contract/index.mjs

@@ -4,7 +4,7 @@ import { dirname, resolve } from "node:path";
 import { loadTaskPacket, renderWorkerPrompt } from "./task-packet.mjs";
 import { RESERVED_ARTICLES } from "./articles.mjs";
 import { validateDefinitionOfDone } from "./definition-of-done.mjs";
-import { validateFinalVerification } from "./final-verification.mjs";
+import { validateFinalVerification, validateSharedVerification } from "./final-verification.mjs";
 import { VERIFICATION_LIMITS } from "./verification.mjs";
 import {
   validateCapabilityRequirements,
@@ -23,7 +23,7 @@ export { CONTRACT_VERSION, PROTOCOL_SCHEMA_VERSION } from "../harnesses/index.mj
 const CONTRACT_FIELDS = new Set([
   "schemaVersion", "contractVersion", "id", "campaignId", "goal", "cwd", "sourceIdentity",
   "maxParallel", "pollIntervalMs", "stallTimeoutSec", "timeoutSec",
-  "runtimeDefaults", "runtimes", "nodes", "warnings", "finalVerification", "nodeAdvisory",
+  "runtimeDefaults", "runtimes", "nodes", "warnings", "finalVerification", "sharedVerification", "nodeAdvisory",
 ]);
 const DEFAULTS_FIELDS = new Set(["worker", "judge"]);
 const NODE_FIELDS = new Set([
@@ -39,7 +39,7 @@ const GATE_REVIEWS = new Set(["none", "advisory", "blocking"]);
 
 /** @typedef {{structuredOutput?: boolean, promptTransport?: "stdin"|"argv", sandbox?: boolean, permissions?: boolean, continuation?: boolean, tokenBudget?: boolean, costBudget?: boolean, usage?: boolean, cost?: boolean}} CapabilityRequirements */
 
-/** @typedef {{kind: string, id?: string, campaignId?: string, contractId?: string, nodeId?: string, cwd?: string, gitHead?: string|null, dirtyTreeFingerprint?: string|null, packetHashes?: Record<string, string>, harnessVersions?: Record<string, string|null>}} SourceIdentity */
+/** @typedef {{kind: string, id?: string, campaignId?: string, contractId?: string, nodeId?: string, cwd?: string, gitHead?: string|null, dirtyTreeFingerprint?: string|null, packetHashes?: Record<string, string>, harnessVersions?: Record<string, string|null>, baseRef?: string|null}} SourceIdentity */
 
 /** @typedef {{argv: string[], cwd?: string, timeoutSec?: number, repeat?: number, env?: string[]}} VerificationCommand */
 
@@ -51,7 +51,7 @@ const GATE_REVIEWS = new Set(["none", "advisory", "blocking"]);
 
 /** @typedef {{id: string, type: string, phase: string, runtime?: string, dependsOn: string[], taskPacket: TaskPacket, taskPacketFile?: string, prompt: string, definitionOfDone: import("./definition-of-done.mjs").DefinitionOfDoneItem[], gate: ValidatedGate, timeoutSec?: number, requiredCapabilities: CapabilityRequirements, packetHash: string, sourceIdentity: SourceIdentity, replayPolicy: "safe"|"reconcile"|"never"}} ValidatedNode */
 
-/** @typedef {{schemaVersion: number, contractVersion: string, id: string, campaignId: string, goal: string, cwd: string, sourceIdentity: SourceIdentity, runtimes: Record<string, ValidatedRuntime>, runtimeDefaults: {worker?: string, judge?: string}, nodes: ValidatedNode[], maxParallel: number, pollIntervalMs: number, stallTimeoutSec: number, timeoutSec: number, finalVerification?: VerificationCommand[], nodeAdvisory?: NodeAdvisoryPolicy, warnings: string[]}} ValidatedContract */
+/** @typedef {{schemaVersion: number, contractVersion: string, id: string, campaignId: string, goal: string, cwd: string, sourceIdentity: SourceIdentity, runtimes: Record<string, ValidatedRuntime>, runtimeDefaults: {worker?: string, judge?: string}, nodes: ValidatedNode[], maxParallel: number, pollIntervalMs: number, stallTimeoutSec: number, timeoutSec: number, finalVerification?: VerificationCommand[], sharedVerification?: VerificationCommand[], nodeAdvisory?: NodeAdvisoryPolicy, warnings: string[]}} ValidatedContract */
 /** @typedef {{costUsd?: number, durationSec?: number}} NodeAdvisoryPolicy */
 
 /** @typedef {"pending"|"running"|"done"|"no-op"|"blocked"|"failed"|"exhausted"|"stalled"|"canceled"} NodeStatus */
@@ -147,7 +147,7 @@ export function validateContract(raw, contractPath, options = {}) {
   }
   const rawNodes = /** @type {JsonObject[]} */ (raw.nodes);
   const ids = new Set();
-  /** @type {{path: string, label: string}[][]} */
+  /** @type {{path: string, label: string, kind: "read"|"acknowledged"}[][]} */
   const deferredReadsByNode = [];
   const nodes = rawNodes.map((node, index) => {
     assertObject(node, `nodes[${index}]`);
@@ -165,12 +165,12 @@ export function validateContract(raw, contractPath, options = {}) {
     if (!Array.isArray(dependsOn) || dependsOn.some((id) => typeof id !== "string")) {
       throw new TypeError(`nodes[${index}].dependsOn must be an array of ids`);
     }
-    // A readFiles entry that names a file no dependency has produced yet is a
-    // missing read today, but the graph is not known until every node is
-    // loaded. Collect the candidate here; the second pass below resolves each
-    // against the node's transitive closure once all packets and dependsOn
-    // edges are in hand.
-    /** @type {{path: string, label: string}[]} */
+    // A readFiles -- or scopeAcknowledged -- entry that names a file no
+    // dependency has produced yet is a missing path today, but the graph is not
+    // known until every node is loaded. Collect the candidate here; the second
+    // pass below resolves each against the node's transitive closure once all
+    // packets and dependsOn edges are in hand.
+    /** @type {{path: string, label: string, kind: "read"|"acknowledged"}[]} */
     const deferredReads = [];
     const taskPacket = loadTaskPacket(node, contractDir, cwd, index, { deferMissingReads: true, deferredReads, persisted });
     deferredReadsByNode.push(deferredReads);
@@ -234,21 +234,22 @@ export function validateContract(raw, contractPath, options = {}) {
   }
   assertAcyclic(nodes);
 
-  // Second pass: a readFiles entry deferred at packet load is accepted only
-  // when some transitive dependency produces it -- declares the identical path
-  // in its writeFiles, or the path sits under a dependency's directory-shaped
-  // writeRoots entry (a file-shaped entry authorizes exactly that path). Every
-  // other caller of validateTaskPacket keeps rejecting the missing read inline;
-  // this graph-aware deferral is a contract-loading capability only. Persisted
-  // loads never defer -- they skipped the existence probe, so there is nothing
-  // to resolve and nothing to stat.
+  // Second pass: a readFiles or scopeAcknowledged entry deferred at packet
+  // load is accepted only when some transitive dependency produces it --
+  // declares the identical path in its writeFiles, or the path sits under a
+  // dependency's directory-shaped writeRoots entry (a file-shaped entry
+  // authorizes exactly that path). Every other caller of validateTaskPacket
+  // keeps rejecting the missing path inline; this graph-aware deferral is a
+  // contract-loading capability only. Persisted loads never defer -- they
+  // skipped the existence probe, so there is nothing to resolve and nothing to
+  // stat.
   if (!persisted) {
     for (const [index, node] of nodes.entries()) {
       const deferredReads = deferredReadsByNode[index];
       if (deferredReads.length === 0) continue;
       const closure = transitiveDependencyClosure(node, nodes);
       for (const { path, label } of deferredReads) {
-        if (!dependencyCoversRead(closure, path, cwd)) {
+        if (!dependencyCoversPath(closure, path, cwd)) {
           throw new TypeError(`${label} does not exist: ${path}`);
         }
       }
@@ -351,13 +352,15 @@ export function validateContract(raw, contractPath, options = {}) {
     stallTimeoutSec: positiveNumber(raw.stallTimeoutSec ?? 300, "contract.stallTimeoutSec"),
     timeoutSec: positiveNumber(raw.timeoutSec ?? 2_400, "contract.timeoutSec"),
     finalVerification: validateFinalVerification(raw.finalVerification, "contract.finalVerification"),
+    sharedVerification: validateSharedVerification(raw.sharedVerification, "contract.sharedVerification"),
     nodeAdvisory: validateNodeAdvisory(raw.nodeAdvisory),
     warnings,
   });
   // The persisted load is a replay, not a re-authoring: it accepts only bytes
   // whose digest matches the decision frozen at launch. A changed DAG, gate,
-  // runtime selection, timeout, definition of done or finalVerification leaves
-  // every packetHash untouched, so only this digest refuses it.
+  // runtime selection, timeout, definition of done, finalVerification or
+  // sharedVerification leaves every packetHash untouched, so only this digest
+  // refuses it.
   if (persisted && options.contractDigest !== undefined && contractDigest(raw) !== options.contractDigest) {
     throw new TypeError("persisted contract does not match the contractDigest recorded at run creation; the stored contract was modified after the run was created");
   }
@@ -593,7 +596,7 @@ function transitiveDependencyClosure(node, nodes) {
 }
 
 /**
- * Whether a transitive dependency produces the deferred read: it declares the
+ * Whether a transitive dependency produces the deferred path: it declares the
  * identical path in `writeFiles`, or the path sits under a directory-shaped
  * `writeRoots` entry. A `writeRoots` entry that names an existing regular file
  * authorizes exactly that path and nothing beneath it, mirroring the
@@ -604,7 +607,7 @@ function transitiveDependencyClosure(node, nodes) {
  * @param {string} cwd
  * @returns {boolean}
  */
-function dependencyCoversRead(closure, path, cwd) {
+function dependencyCoversPath(closure, path, cwd) {
   for (const dependency of closure) {
     const packet = dependency.taskPacket;
     if ((packet.writeFiles ?? []).includes(path)) return true;

package/src/contract/runtime.mjs

@@ -41,7 +41,7 @@ const PRICING_FIELDS = new Set(["inputPerMTok", "cachedInputPerMTok", "outputPer
 const SNAPSHOT_RUNTIME_FIELDS = new Set(["id", ...RUNTIME_FIELDS, "capabilities"]);
 const CAPABILITY_FIELDS = new Set([
   "structuredOutput", "promptTransport", "sandbox", "permissions", "continuation", "tokenBudget", "costBudget",
-  "usage", "cost", "toolPolicy", "streamsOutput", "maxArgvPromptBytes",
+  "usage", "cost", "toolPolicy", "streamsOutput", "signalsProcesses", "maxArgvPromptBytes",
 ]);
 /** @typedef {{id: string, type?: string, runtime?: string, gate: {runtime?: string}, status?: NodeStatus, errorCode?: string, currentRuntime?: string}} RoutableNode */
 /** @typedef {{status?: NodeStatus, errorCode?: string, currentRuntime?: string, assignment?: string, availability?: Record<string, RuntimeAvailability>}} RoutingEvent */
@@ -187,6 +187,10 @@ export function validateCapabilities(value, label) {
   for (const name of ["structuredOutput", "sandbox", "permissions", "continuation", "tokenBudget", "costBudget", "usage", "cost", "toolPolicy", "streamsOutput"]) {
     if (typeof value[name] !== "boolean") throw new TypeError(`${label}.${name} must be boolean`);
   }
+  // `signalsProcesses` is tri-state: null is a sandbox nobody has measured.
+  if (value.signalsProcesses !== null && typeof value.signalsProcesses !== "boolean") {
+    throw new TypeError(`${label}.signalsProcesses must be boolean or null`);
+  }
   if (!["stdin", "argv"].includes(/** @type {string} */ (value.promptTransport))) {
     throw new TypeError(`${label}.promptTransport is invalid`);
   }

package/src/contract/task-packet.mjs

@@ -19,11 +19,18 @@ const FIELDS = new Set([
   "verification",
 ]);
 const PROMPT_MAX_BYTES = 64 * 1024;
+/**
+ * The `## Verification` preamble every worker prompt carries. The controller's
+ * recorded run is the proof; a self-run is optional and must be a quick,
+ * process-free command, so a sandbox that cannot signal processes never hangs
+ * on the node's own verification.
+ */
+const VERIFICATION_PARAGRAPH = "The controller runs every command below after you report; its recorded results are the proof of this node. Running a command yourself is optional and only for one that finishes in seconds and spawns no long-lived process. Keep output bounded (pipe through `| tail -n 200`). Never wait on a background job, never run the whole test suite, and never run tests that start and terminate other processes.";
 
 /**
- * `validateRelativePath`'s answer when a read path is absent and the caller
- * asked to defer the missing-read verdict rather than throw it. Only contract
- * loading opts in; every other caller throws the missing-read error in place.
+ * `validateRelativePath`'s answer when a path is absent and the caller asked to
+ * defer the missing-path verdict rather than throw it. Only contract loading
+ * opts in; every other caller throws the missing-path error in place.
  */
 const DEFERRED_MISSING = Symbol("deferred-missing");
 
@@ -47,7 +54,7 @@ const DEFERRED_MISSING = Symbol("deferred-missing");
  * @param {string} contractDir
  * @param {string} cwd
  * @param {number} index
- * @param {{deferMissingReads?: boolean, deferredReads?: {path: string, label: string}[], persisted?: boolean}} [options]
+ * @param {{deferMissingReads?: boolean, deferredReads?: {path: string, label: string, kind: "read"|"acknowledged"}[], persisted?: boolean}} [options]
  * @returns {TaskPacket}
  */
 export function loadTaskPacket(node, contractDir, cwd, index, options = {}) {
@@ -117,7 +124,7 @@ export function renderWorkerPrompt(packet, nodeId) {
     ...bulletOrNone(packet.nonGoals),
     "",
     "## Verification",
-    "Run each command yourself before reporting done. Keep command output bounded: pipe long output through `| tail -n 200` (or similar) and never paste full test or fuzz logs into your context or results.",
+    VERIFICATION_PARAGRAPH,
     ...packet.verification.map((command) => `- ${command.argv.join(" ")}`),
     "",
     "## Required output",
@@ -134,7 +141,7 @@ export function renderWorkerPrompt(packet, nodeId) {
  * @param {unknown} packet
  * @param {number} index
  * @param {string} cwd
- * @param {{deferMissingReads?: boolean, deferredReads?: {path: string, label: string}[], persisted?: boolean}} [options]
+ * @param {{deferMissingReads?: boolean, deferredReads?: {path: string, label: string, kind: "read"|"acknowledged"}[], persisted?: boolean}} [options]
  * @returns {TaskPacket}
  */
 export function validateTaskPacket(packet, index, cwd, options = {}) {
@@ -207,18 +214,20 @@ export function validateTaskPacket(packet, index, cwd, options = {}) {
 
   if (!persisted) {
     const deferMissingReads = options.deferMissingReads === true;
-    /** @type {{path: string, label: string}[]} */
+    /** @type {{path: string, label: string, kind: "read"|"acknowledged"}[]} */
     const deferredReads = options.deferredReads ?? [];
     normalizedReadFiles.forEach((path, pathIndex) => {
       const label = `nodes[${index}].taskPacket.readFiles[${pathIndex}]`;
       const result = validateRelativePath(path, label, cwd, true, { deferMissing: deferMissingReads });
-      if (result === DEFERRED_MISSING) deferredReads.push({ path, label });
+      if (result === DEFERRED_MISSING) deferredReads.push({ path, label, kind: "read" });
     });
     if (writeFiles !== undefined) /** @type {string[]} */ (writeFiles).forEach((path, pathIndex) => {
       validateRelativePath(path, `nodes[${index}].taskPacket.writeFiles[${pathIndex}]`, cwd, false);
     });
     /** @type {string[]} */ (scopeAcknowledged).forEach((path, pathIndex) => {
-      validateRelativePath(path, `nodes[${index}].taskPacket.scopeAcknowledged[${pathIndex}]`, cwd, true);
+      const label = `nodes[${index}].taskPacket.scopeAcknowledged[${pathIndex}]`;
+      const result = validateRelativePath(path, label, cwd, true, { deferMissing: deferMissingReads });
+      if (result === DEFERRED_MISSING) deferredReads.push({ path, label, kind: "acknowledged" });
     });
     for (const [commandIndex, command] of verification.entries()) {
       if (command.cwd !== undefined) {
@@ -426,6 +435,7 @@ function renderDiscoveryPrompt(packet, nodeId) {
     'Return exactly one worker-result JSON object, with no markdown or prose. Set status to "done", missingContext to [], and artifacts to an array containing exactly one JSON-stringified execution task packet with every required taskPacket field. The packet readFiles and writeFiles must be non-empty and scoped to this repository.',
     "",
     "## Verification",
+    VERIFICATION_PARAGRAPH,
     ...packet.verification.map((command) => `- ${command.argv.join(" ")}`),
   ];
   const prompt = `${lines.join("\n")}\n`;
@@ -467,6 +477,7 @@ function renderAutonomousPrompt(packet, nodeId) {
     ...bulletOrNone(packet.nonGoals),
     "",
     "## Verification",
+    VERIFICATION_PARAGRAPH,
     ...packet.verification.map((command) => `- ${command.argv.join(" ")}`),
     "",
     "## Required output",

package/src/contract/verification.mjs

@@ -38,7 +38,7 @@ export const VERIFICATION_LIMITS = Object.freeze({
 /**
  * Bounded evidence captured for one attempt.
  *
- * @typedef {{passed: boolean, stdout: string, stderr: string, error: string|null, exitCode: number|null, signal: string|null, timedOut: boolean, durationMs: number|null}} VerificationAttemptResult
+ * @typedef {{passed: boolean, stdout: string, stderr: string, error: string|null, exitCode: number|null, signal: string|null, timedOut: boolean, durationMs: number|null, signalDeath?: boolean}} VerificationAttemptResult
  */
 
 /**

package/src/engine/backoff.mjs

@@ -9,7 +9,7 @@
  * third time buys nothing: change provider, or stop and say so.
  *
  * Everything here is a pure decision. Persisting it — the routing history,
- * the override, the node transition — stays in runner.mjs, so this module can
+ * the override, the node transition — stays in cli.mjs, so this module can
  * be tested without a run directory, a lease, or a provider.
  */
 import { nextHop, nextSynthesizedRuntime, synthesizedChain } from "./failover.mjs";

package/src/engine/dispatch.mjs

@@ -9,7 +9,7 @@
  * which made dispatch depend on review policy and on settlement, and that is
  * the shape that kept `engine/` a web instead of a stack.
  */
-import { JUDGE_SCHEMA, judgePrompt } from "./prompts.mjs";
+import { JUDGE_SCHEMA, appendSandboxNotice, judgePrompt } from "./prompts.mjs";
 import { LockLostError } from "../run/lock.mjs";
 import { TOOL_OUTPUT_LIMIT_BYTES } from "../harnesses/exec-jsonl/index.mjs";
 import { appendPreviousAttempt } from "./retry.mjs";
@@ -404,6 +404,8 @@ export function startWorker(contract, node, state, runDir, running, prompt, lock
   // so it is appended to the resolved prompt rather than the candidate handed
   // to phaseInvocationPlan.
   phasePlan.prompt = appendPreviousAttempt(phasePlan.prompt, state.previousAttempt);
+  // The resolved worker's sandbox is a dispatch-time fact, not a packet one.
+  phasePlan.prompt = appendSandboxNotice(phasePlan.prompt, runtime);
   // The worker prompt directs the provider to write the canonical result file;
   // make sure the directory exists before the provider is asked to.
   const resultPath = attemptWorkerResultPath(runDir, node.id, workspace);
@@ -526,11 +528,11 @@ export function startResultMaterialization(contract, node, state, runDir, runnin
   const paths = logPaths(runDir, node.id, "worker", state.attempt);
   const workspace = attemptWorkspace(state) ?? contract.cwd;
   const resultPath = attemptWorkerResultPath(runDir, node.id, workspace);
-  const prompt = [
+  const prompt = appendSandboxNotice([
     `${RESULT_MATERIALIZATION_PROMPT_HEADER} Do not inspect, implement, verify, or invoke tools.`,
     `Your only job in this single bounded turn is to write the required worker-result JSON object to: ${resultPath}`,
     "Then return that same JSON object as the final message.",
-  ].join("\n\n");
+  ].join("\n\n"), materializationRuntime);
   let baseline;
   try {
     baseline = captureWorkspaceSnapshot(workspace);

package/src/engine/gate.mjs

@@ -21,8 +21,14 @@
  *
  * Nothing here is exported for a caller: this file is a program. Every name
  * below is module-local.
+ *
+ * It also exits when the release file's directory is gone (measured
+ * 2026-09-16: gate processes from a prior day's test runs, spawned into a
+ * temp directory the failed test never cleaned up, were still alive and
+ * waiting for a release file that could now never appear).
  */
 import { existsSync, readFileSync, statSync, openSync, closeSync, readSync, writeSync } from "node:fs";
+import { dirname } from "node:path";
 import { spawn } from "node:child_process";
 
 /** @typedef {{executable: string, args: string[], cwd: string, promptTransport: "stdin"|"argv", harness: string, env: Record<string, string|null>|null, stdoutPath: string, stderrPath: string}} GateConfig */
@@ -158,8 +164,14 @@ function childEnv() {
 process.on("SIGTERM", () => stopProvider());
 process.on("SIGINT", () => stopProvider());
 
+/** @returns {boolean} */
+function releaseDirectoryGone() {
+  return !existsSync(dirname(releasePath));
+}
+
 const timer = setInterval(() => {
   if (!parentAlive()) { clearInterval(timer); stopProvider(); return; }
+  if (releaseDirectoryGone()) { clearInterval(timer); stopProvider(); return; }
   if (!existsSync(releasePath)) return;
   clearInterval(timer);
   const stdoutFd = openSync(config.stdoutPath, "wx", 0o600);

package/src/engine/process-identity.mjs

@@ -13,6 +13,41 @@ import { processStartToken } from "../run/lock.mjs";
 /** @typedef {import("node:child_process").ChildProcess} ChildProcess */
 /** @typedef {{pid: number|null, processGroupId?: number|null, processStartToken?: string|null}} InvocationProbe */
 
+/**
+ * Whether a controller may signal a pid's process group at all. It may not when
+ * the pid is the calling process -- whose group is the controller's own -- or
+ * its parent, whose group is the runner (or host scheduler) that spawned the
+ * controller: either signal takes down the caller instead of the invocation.
+ * The refusal is recorded and returned, never thrown.
+ *
+ * The line goes to the injected sink when a caller supplied one, otherwise to
+ * stderr; this function owns no run directory and no event-log schema, so
+ * stderr is the one recorder it always has. Recording is diagnostic, so a
+ * failure to record must never turn the refusal into a throw.
+ *
+ * @param {number} pid
+ * @param {((event: Record<string, unknown>) => void)|undefined} [append] injected event sink
+ * @returns {boolean} true when the pid is this process or its parent and the signal was refused
+ */
+export function refuseSelfSignal(pid, append) {
+  const relation = pid === process.pid ? "self" : pid === process.ppid ? "parent" : null;
+  if (relation === null) return false;
+  const event = {
+    type: "controller_self_signal_refused",
+    at: new Date().toISOString(),
+    pid,
+    processPid: process.pid,
+    relation,
+  };
+  try {
+    if (append) append(event);
+    else process.stderr.write(`[warn] controller_self_signal_refused ${JSON.stringify(event)}\n`);
+  } catch {
+    // The refusal is diagnostic: a failed recorder must never become a throw.
+  }
+  return true;
+}
+
 /**
  * A process group answers a signal-0 probe. EPERM means the group exists but is
  * not this user's, which is no more "ours" than a missing group.
@@ -57,6 +92,10 @@ export function processStartTokenMatches(invocation) {
  */
 export function invocationOwned(invocation, options = {}) {
   if (!invocation?.pid || !Number.isInteger(invocation.pid)) return false;
+  // A controller does not spawn itself or its parent: a recorded pid that names
+  // either can never be an invocation this controller owns, whatever token or
+  // child handle accompanies it, and signalling it would hit the caller.
+  if (invocation.pid === process.pid || invocation.pid === process.ppid) return false;
   try {
     process.kill(invocation.pid, 0);
   } catch {

package/src/engine/prompts.mjs

@@ -1,6 +1,7 @@
 import { validateWorkerResult } from "../contract/worker-result.mjs";
 import { scopeFindingsPromptSection } from "../contract/scope-findings.mjs";
 import { JUDGE_ENVELOPE_REASON, JUDGE_FINDING_ENVELOPE_REASON, JUDGE_LIMITS } from "../contract/judge-envelope.mjs";
+import { harnessCapabilities } from "../harnesses/index.mjs";
 
 /** @typedef {{id: string, definitionOfDone: import("../contract/definition-of-done.mjs").DefinitionOfDoneItem[], taskPacket: {mode?: "execution"|"discovery"|"autonomous", objective: string, instructions: string[], writeFiles?: string[], writeRoots?: string[], verification: {argv: string[]}[]}}} JudgeNode */
 /** @typedef {{verdict: "pass"|"fail"|"invalid_judge_output", maxSeverity: "none"|"minor"|"major"|"critical", summary: string, findings: {severity: "minor"|"major"|"critical", description: string, evidence: string}[]}} JudgeVerdict */
@@ -276,6 +277,23 @@ export function retryPrompt(node, verdict) {
     : prompt;
 }
 
+/**
+ * Append the `## Sandbox` warning a resolved worker runtime earns. Only a
+ * harness whose adapter declares `signalsProcesses === false` gets it: that
+ * sandbox cannot signal child processes or read the process table, so a test
+ * that starts and terminates a child hangs until the executor's cap. An
+ * unmeasured harness (`null`) is left alone — no measurement justifies the
+ * warning.
+ *
+ * @param {string} prompt
+ * @param {{harness: string}} runtime
+ * @returns {string}
+ */
+export function appendSandboxNotice(prompt, runtime) {
+  if (harnessCapabilities(runtime).signalsProcesses !== false) return prompt;
+  return `${prompt}\n\n## Sandbox\nYour harness runs you in a sandbox that cannot signal other processes or read the process table. A test that starts and terminates a child process hangs here until the executor's cap and is then killed as a stall. Do not run such tests; the controller runs them after you report.`;
+}
+
 /**
  * @param {unknown} value
  * @param {number} maxBytes

package/src/engine/resume.mjs

@@ -17,7 +17,7 @@ import { Buffer } from "node:buffer";
 import { acquire as acquireLock } from "../run/lock.mjs";
 import { applyInvalidWorkerResult, assertRunMutable, handleProviderExhaustion } from "./lifecycle.mjs";
 import { applyJudgeResult } from "./review.mjs";
-import { assertSourceUnchanged, captureRunIdentity, statesFingerprint } from "./run-identity.mjs";
+import { assertSourceUnchanged, captureRunIdentity, recordedBaseRef, statesFingerprint } from "./run-identity.mjs";
 import { attemptWorkspace, attemptWorktreePath, gitHead, removeWorktree, runRefName } from "../repo/worktree.mjs";
 import { canonicalWorkerResultText, isResultMaterializationInvocation, materializeAttemptResult, recoverWorkerResult } from "./result-file.mjs";
 import { checkPersistedWorkerScope, persistedScopeBoundary, reconcileAmbiguousWorkerRestart, resolveUnknownEffect } from "./scope.mjs";
@@ -114,7 +114,7 @@ export async function resumeRun(runDirPath, options = {}) {
       node.id,
       persistedScopeBoundary(contract, node, states.get(node.id), attemptWorkspace(states.get(node.id)) ?? contract.cwd),
     ]));
-    const sourceIdentity = await captureRunIdentity(contract, scopeBoundaries);
+    const sourceIdentity = await captureRunIdentity(contract, scopeBoundaries, recordedBaseRef(storedMetadata) ?? undefined);
     const identity = assertSourceUnchanged(storedMetadata.sourceIdentity, sourceIdentity);
     // A resume is an explicit instruction to continue the run: it consumes a
     // stale cancel request instead of letting it re-cancel the retried nodes.

package/src/engine/review.mjs

@@ -21,7 +21,7 @@ import {
 } from "../contract/review-modes.mjs";
 
 import { errorMessage, excerpt } from "../util.mjs";
-import { appendTransitionEvent, transition } from "./state.mjs";
+import { appendTransitionEvent, transition, writeNode } from "./state.mjs";
 import { startJudge } from "./dispatch.mjs";
 import { applyRejection, raiseNodeAttention, settleDone } from "./settle.mjs";
 
@@ -154,6 +154,14 @@ export async function applyJudgeResult(contract, node, state, result, runDir, lo
       await raiseNodeAttention(campaignPath, runDir, state, "judge_protocol");
       return;
     }
+    // The verdict and the spent bound are durable before the blocked
+    // transition: a controller loss in this gap reads the settled re-ask from
+    // the node snapshot instead of spending a second one. No await separates
+    // the two writes, so the durable record cannot be observed only by luck.
+    writeNode(runDir, state, lock);
+    if (process.env.FABERUN_JUDGE_REASK_INTERRUPT === "after-verdict") {
+      throw new Error("judge re-ask interrupted after verdict persistence");
+    }
     transition(runDir, state, "blocked", {
       phase: "judge",
       gate: verdict,

package/src/engine/run-command.mjs

@@ -99,9 +99,30 @@ async function runRepeatedCommand(command, baseCwd, commandIndex, options) {
   const attempts = [];
   const repeat = command.repeat ?? 1;
   for (let attempt = 1; attempt <= repeat; attempt += 1) {
-    attempts.push(await runCommand(command, baseCwd, command.cwd ?? ".", attempt, options.signal, options, commandIndex));
+    const result = await runCommand(command, baseCwd, command.cwd ?? ".", attempt, options.signal, options, commandIndex);
+    if (signalDeathRetry(result, options.signal)) {
+      attempts.push({ ...result, signalDeath: true });
+      attempts.push(await runCommand(command, baseCwd, command.cwd ?? ".", attempt, options.signal, options, commandIndex));
+    } else {
+      attempts.push(result);
+    }
   }
-  return { ...command, cwd: resolveVerificationCwd(baseCwd, command.cwd ?? "."), passed: attempts.every((item) => item.passed), attempts };
+  const passed = attempts.filter((item) => !item.signalDeath).every((item) => item.passed);
+  return { ...command, cwd: resolveVerificationCwd(baseCwd, command.cwd ?? "."), passed, attempts };
+}
+/**
+ * Whether an attempt died from a signal the controller itself did not send.
+ * `terminateGroup` only fires from the timeout and abort paths below, so a
+ * `signal` with neither set is evidence of an external kill (OOM, an operator
+ * `kill`, a flaky sandbox) rather than a verdict on the command under test,
+ * and gets one retry instead of failing the node outright.
+ *
+ * @param {VerificationAttemptResult} result
+ * @param {AbortSignal|undefined} signal
+ * @returns {boolean}
+ */
+function signalDeathRetry(result, signal) {
+  return Boolean(result.signal) && !result.timedOut && !signal?.aborted;
 }
 /**
  * The mutation case: the entry passes on the mutant-kill fraction, and every

package/src/engine/run-identity.mjs

@@ -181,6 +181,20 @@ export function setLaunchBaseRef(baseRef) {
   pendingLaunchBaseRef = baseRef ?? null;
 }
 
+/**
+ * The base ref a run was launched against, when it was launched with
+ * `--base-ref`. A run recorded before this field existed, or launched
+ * without the flag, has none — a resume of that run keeps comparing against
+ * the checkout's own HEAD.
+ *
+ * @param {RunMetadata|undefined} metadata
+ * @returns {string|null}
+ */
+export function recordedBaseRef(metadata) {
+  const baseRef = metadata?.sourceIdentity?.baseRef;
+  return typeof baseRef === "string" && baseRef.length > 0 ? baseRef : null;
+}
+
 /**
  * Capture the run's source identity, including one version-only probe per
  * distinct routed runtime (a local binary call, no model tokens) so a later

package/src/engine/scheduler.mjs

@@ -41,7 +41,7 @@ import { appendUsageRecord, invocationCost, invocationUsage, recordInvocationUsa
 import { captureNodeScopeBoundaries, checkWorkerScope, emptyScope } from "./scope.mjs";
 import { validateContract } from "../contract/index.mjs";
 import { validateNodeSnapshot } from "../contract/snapshot.mjs";
-import { finalVerificationCommands } from "../contract/final-verification.mjs";
+import { finalVerificationCommands, sharedVerificationCommands } from "../contract/final-verification.mjs";
 import { startJudge, startWorker } from "./dispatch.mjs";
 import { assertEnvironmentReady, captureRunIdentity, createRunMetadata, serializableContract, statesFingerprint } from "./run-identity.mjs";
 import { blockDependents, runtimeAssignments } from "./assignment.mjs";
@@ -94,12 +94,13 @@ export function verificationBudgetMs(commands) {
 /**
  * The budget a node is judged against, in milliseconds. It is the sum of every
  * bounded phase the node can legitimately occupy without a state transition:
- * its worker invocation (`timeoutSec`), its packet verification and the
- * contract's `finalVerification` when it is phase-terminal, an integration
- * candidate run of that same set, and the bounded command proofs of its gate.
- * A frozen node is one that has been silent longer than this, not merely
- * longer than the worker timeout, because a legitimate verification can be
- * minutes long and must not be mistaken for a freeze.
+ * its worker invocation (`timeoutSec`), its packet verification plus the
+ * contract's `sharedVerification` and, when it is phase-terminal, the
+ * contract's `finalVerification`, an integration candidate run of that same
+ * set, and the bounded command proofs of its gate. A frozen node is one that
+ * has been silent longer than this, not merely longer than the worker timeout,
+ * because a legitimate verification can be minutes long and must not be
+ * mistaken for a freeze.
  *
  * @param {ValidatedContract} contract
  * @param {ValidatedNode} node
@@ -107,14 +108,17 @@ export function verificationBudgetMs(commands) {
  */
 export function nodeBudgetBasisMs(contract, node) {
   const defaultTimeoutMs = (node.timeoutSec ?? contract.timeoutSec ?? 60) * 1_000;
+  const sharedMs = verificationBudgetMs(sharedVerificationCommands(contract));
   const packetMs = verificationBudgetMs(node.taskPacket?.verification);
   const finalMs = verificationBudgetMs(finalVerificationCommands(contract, node));
-  // The controller runs the packet set once after the worker and once against
-  // the integration candidate, and the finalVerification set with each.
-  const candidateMs = packetMs + finalMs;
+  // The controller runs the packet set (with the contract-level shared set) once
+  // after the worker and once against the integration candidate, and the
+  // finalVerification set with each.
+  const attemptMs = packetMs + sharedMs;
+  const candidateMs = attemptMs + finalMs;
   const gateTimeoutMs = Math.max(1_000, Math.min(defaultTimeoutMs, 120_000));
   const commandProofs = (node.definitionOfDone ?? []).filter((item) => item.proof?.kind === "command").length;
-  return defaultTimeoutMs + packetMs + candidateMs + commandProofs * gateTimeoutMs + finalMs;
+  return defaultTimeoutMs + attemptMs + candidateMs + commandProofs * gateTimeoutMs + finalMs;
 }
 
 /**
@@ -149,6 +153,26 @@ export function enforceRunningInvariant(runDir, states, running, lock) {
   return parked;
 }
 
+/**
+ * The fingerprint that decides whether a render is due: the shared
+ * `statesFingerprint` (status, phase, attempt, revisions) plus each running
+ * node's verification progress. A verification command completing and the
+ * next one starting changes neither status nor phase, so the shared
+ * fingerprint alone would never notice it; this is the one used to gate
+ * `renderStatusIfChanged` and nothing else, so a resume's drift comparison
+ * still uses the unextended `statesFingerprint`.
+ *
+ * @param {Map<string, NodeSnapshot>} states
+ * @returns {string}
+ */
+function renderFingerprint(states) {
+  const progress = [...states.values()].map((state) => {
+    const verification = /** @type {{progress?: {index: number, total: number, argv: string}}|null|undefined} */ (state.verification);
+    return verification?.progress ? `${state.id}:${verification.progress.index}/${verification.progress.total}:${verification.progress.argv}` : "";
+  }).join("|");
+  return `${statesFingerprint(states)}#${progress}`;
+}
+
 /**
  * @param {string} contractPath
  * @param {{detachedBootstrap?: boolean}} [options] `detachedBootstrap` is set
@@ -290,11 +314,19 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
   let statusFingerprint = null;
   /** @param {boolean} force @param {LockHandle|null} [renderLock] */
   const renderStatusIfChanged = (force = false, renderLock = lock) => {
-    const fingerprint = statesFingerprint(states);
+    const fingerprint = renderFingerprint(states);
     if (!force && fingerprint === statusFingerprint) return;
     statusFingerprint = fingerprint;
     render(runDir, runsDir, contract, states, renderLock);
   };
+  // The tick that owns a running node's verification can be minutes long
+  // (`executeControllerVerification` is awaited on the critical path below),
+  // and that whole time status.json would otherwise report whatever the last
+  // tick left it at. A timer renders between ticks too; it is cheap even when
+  // idle because `renderFingerprint` still change-detects, so a quiet run
+  // writes nothing extra.
+  const statusTimer = setInterval(() => renderStatusIfChanged(), contract.pollIntervalMs);
+  statusTimer.unref();
   let handoffFingerprint = statesFingerprint(states);
   const renderHandoffIfChanged = () => {
     const fingerprint = statesFingerprint(states);
@@ -475,6 +507,7 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
     notifyQueuesByRun.delete(runDir);
     return { runDir, states, ok: false, error };
   } finally {
+    clearInterval(statusTimer);
     process.removeListener("SIGINT", cancel);
     process.removeListener("SIGTERM", cancel);
     process.removeListener("SIGHUP", cancel);