firedrill-run 2.2.5 → 3.0.0

package/dist/cli/src/runner-configuration.js

@@ -0,0 +1,546 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { api } from './auth.js';
+import { API_ORIGIN, CliError } from './http.js';
+import { signRunnerRequest } from './runner-identity.js';
+import { identifier } from './world-contracts.js';
+import { resolveLocalValues } from './local-value-store.js';
+import { voiceChannels, voiceSession } from './runner-voice.js';
+import { checkpointResetBaselines } from './world-checkpoint-scopes.js';
+import { applicationStateReference } from '../../contracts/application-state-contracts.js';
+import { readLocalClaim } from './runner-claim-reads.js';
+import { localConfigurationIdentityMatches } from '../../contracts/local-configuration-contracts.js';
+import { executionDriverMatches, executionAuthorityMatches, driverBasisMatches } from '../../contracts/agent-execution-contracts.js';
+const HASH = /^[a-f0-9]{64}$/;
+const VARIABLE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+const TOKEN = /^[A-Za-z0-9_-]{32,256}$/;
+const FORBIDDEN_HEADERS = new Set(['host', 'content-length', 'content-type', 'accept', 'connection', 'transfer-encoding',
+    'upgrade', 'te', 'trailer', 'expect', 'forwarded', 'via', 'cookie', 'set-cookie', 'proxy-authorization',
+    'proxy-authenticate', 'range', 'accept-encoding', 'mcp-session-id', 'mcp-protocol-version']);
+const invalid = () => new CliError('local_runtime_packet_invalid', 'The native execution packet does not match the exact approved inputs. No target was started.');
+const record = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+function startingData(control, owner, inputs) {
+    const entry = inputs.manifest.entries.find(one => one.part === 'dataset');
+    const placementBinding = owner.purpose === 'world_session' ? null : control.dataset_binding;
+    if (control.dataset === null) {
+        if (entry || control.dataset_transfer !== null || placementBinding !== null)
+            throw invalid();
+        return;
+    }
+    const value = control.dataset, transfer = control.dataset_transfer;
+    const fields = ['schema', 'dataset_id', 'world_id', 'source_id', 'observation_id', 'configuration_id', 'configuration_digest',
+        'world_revision', 'validation_job_id', 'native_bundle_digest', 'engine_source_digest', 'archive_digest', 'index_digest', 'edit_count', 'recipe_artifact'];
+    if (!entry || !record(value) || Object.keys(value).sort().join(',') !== fields.sort().join(',')
+        || value.schema !== 'firedrill.world-dataset-selection.v1'
+        || typeof value.native_bundle_digest !== 'string' || !/^sha256:[a-f0-9]{64}$/.test(value.native_bundle_digest)
+        || !Number.isSafeInteger(value.world_revision) || Number(value.world_revision) < 1
+        || !Number.isSafeInteger(value.edit_count) || Number(value.edit_count) < 0 || Number(value.edit_count) > 100000
+        || !record(transfer) || Object.keys(transfer).sort().join(',') !== 'sha256,size'
+        || transfer.size !== entry.size || transfer.sha256 !== entry.sha256)
+        throw invalid();
+    for (const name of ['dataset_id', 'world_id', 'source_id', 'observation_id', 'configuration_id', 'validation_job_id']) {
+        if (typeof value[name] !== 'string' || identifier(value[name]) !== value[name])
+            throw invalid();
+    }
+    for (const name of ['configuration_digest', 'engine_source_digest', 'archive_digest', 'index_digest']) {
+        if (typeof value[name] !== 'string' || !HASH.test(value[name]))
+            throw invalid();
+    }
+    let placement = value;
+    if (placementBinding !== null) {
+        if (owner.purpose !== 'trial')
+            throw invalid();
+        const binding = placementBinding;
+        const fields = ['schema', 'comparison_id', 'comparison_sha256', 'selection_sha256', 'world_id', 'world_revision',
+            'source_id', 'configuration_id', 'configuration_digest', 'validation_job_id', 'native_bundle_digest', 'engine_source_digest'];
+        if (!record(binding) || Object.keys(binding).sort().join(',') !== fields.sort().join(',')
+            || binding.schema !== 'firedrill.world-dataset-execution.v1'
+            || binding.selection_sha256 !== createHash('sha256').update(canonical(value)).digest('hex')
+            || !Number.isSafeInteger(binding.world_revision) || Number(binding.world_revision) < 1)
+            throw invalid();
+        for (const name of ['comparison_id', 'world_id', 'source_id', 'configuration_id', 'validation_job_id']) {
+            if (typeof binding[name] !== 'string' || identifier(binding[name]) !== binding[name])
+                throw invalid();
+        }
+        for (const name of ['comparison_sha256', 'configuration_digest', 'engine_source_digest']) {
+            if (typeof binding[name] !== 'string' || !HASH.test(binding[name]))
+                throw invalid();
+        }
+        placement = binding;
+    }
+    if (placement.world_id !== owner.world || placement.configuration_digest !== owner.configurationDigest
+        || placement.native_bundle_digest !== control.bundle_digest || placement.engine_source_digest !== control.engine_source_digest)
+        throw invalid();
+    const archive = value.recipe_artifact;
+    if (!record(archive) || Object.keys(archive).sort().join(',') !== 'generation,id,sha256,size'
+        || typeof archive.id !== 'string' || identifier(archive.id) !== archive.id || typeof archive.generation !== 'string'
+        || !/^[1-9][0-9]{0,30}$/.test(archive.generation) || typeof archive.sha256 !== 'string' || !HASH.test(archive.sha256)
+        || !Number.isSafeInteger(archive.size) || Number(archive.size) < 1 || Number(archive.size) > 8 * 1024 ** 2)
+        throw invalid();
+}
+function canonical(value) {
+    if (Array.isArray(value))
+        return '[' + value.map(canonical).join(',') + ']';
+    if (record(value))
+        return '{' + Object.keys(value).sort().map(key => JSON.stringify(key) + ':' + canonical(value[key])).join(',') + '}';
+    const result = JSON.stringify(value);
+    if (result === undefined)
+        throw invalid();
+    return result;
+}
+/** Remove references, not a claim of cryptographic zeroization of JS strings. */
+export function clearRuntimeConfiguration(value) {
+    if (!record(value))
+        return;
+    if (record(value.target_phases))
+        for (const phase of ['build', 'runtime']) {
+            const values = value.target_phases[phase];
+            if (record(values))
+                for (const name of Object.keys(values))
+                    delete values[name];
+        }
+    if (Array.isArray(value.model_channels))
+        for (const item of value.model_channels) {
+            if (record(item)) {
+                delete item.token;
+                delete item.endpoint;
+            }
+        }
+    if (Array.isArray(value.real_channels))
+        for (const item of value.real_channels) {
+            if (record(item)) {
+                delete item.token;
+                delete item.endpoint;
+                if (record(item.markers))
+                    for (const name of Object.keys(item.markers))
+                        delete item.markers[name];
+            }
+        }
+    if (record(value.participant_channel)) {
+        delete value.participant_channel.token;
+        delete value.participant_channel.endpoint;
+    }
+    if (Array.isArray(value.voice_channels))
+        for (const item of value.voice_channels) {
+            if (record(item)) {
+                delete item.token;
+                delete item.endpoint;
+            }
+        }
+}
+function validateRealChannels(value, owner, variables) {
+    const channels = value.real_channels, control = value.control;
+    if (!Array.isArray(channels) || !record(control) || !record(control.dependency_bindings)
+        || !Array.isArray(control.dependency_bindings.real_channels) || !Array.isArray(control.dependency_bindings.dependencies)
+        || !record(value.target_phases) || !record(value.target_phases.build) || !record(value.target_phases.runtime)
+        || channels.length > 0 && (owner.realAccountAccess !== true || owner.purpose !== 'trial' && !(['validation', 'world_session'].includes(owner.purpose) && control.validation_scope === 'target_startup_only'
+            && typeof control.startup_authorization_sha256 === 'string' && HASH.test(control.startup_authorization_sha256))))
+        throw invalid();
+    const expected = [];
+    for (const item of control.dependency_bindings.dependencies) {
+        if (!record(item) || typeof item.service_key !== 'string' || !HASH.test(item.service_key)
+            || typeof item.mode !== 'string' || !['real', 'simulated'].includes(item.mode))
+            throw invalid();
+        if (item.mode === 'real')
+            expected.push(item.service_key);
+    }
+    const identifiers = new Set(), services = new Set(), projected = [];
+    for (const item of channels) {
+        if (!record(item) || Object.keys(item).sort().join(',') !== 'authentication,base_path,credential_variables,endpoint,endpoint_variable,id,markers,routes,service_key,token'
+            || typeof item.id !== 'string' || identifier(item.id) !== item.id || identifiers.has(item.id)
+            || typeof item.service_key !== 'string' || !HASH.test(item.service_key) || services.has(item.service_key)
+            || typeof item.endpoint_variable !== 'string' || !VARIABLE.test(item.endpoint_variable) || variables.has(item.endpoint_variable)
+            || typeof item.endpoint !== 'string' || typeof item.token !== 'string' || !TOKEN.test(item.token)
+            || typeof item.base_path !== 'string' || item.base_path.length > 2048 || !/^(?:\/[A-Za-z0-9_~.-]+)*$/.test(item.base_path)
+            || item.base_path.split('/').some(part => part === '.' || part === '..')
+            || !Array.isArray(item.authentication) || item.authentication.length > 16 || !Array.isArray(item.credential_variables)
+            || !record(item.markers) || !Array.isArray(item.routes) || !item.routes.length)
+            throw invalid();
+        const endpoint = new URL(item.endpoint);
+        if (endpoint.origin !== API_ORIGIN || endpoint.username || endpoint.password || endpoint.search || endpoint.hash
+            || endpoint.pathname !== '/api/internal/real-dependency/' + item.id)
+            throw invalid();
+        variables.add(item.endpoint_variable);
+        if (Object.hasOwn(value.target_phases.build, item.endpoint_variable) || Object.hasOwn(value.target_phases.runtime, item.endpoint_variable))
+            throw invalid();
+        const names = [], headers = new Set();
+        for (const auth of item.authentication) {
+            if (!record(auth) || Object.keys(auth).sort().join(',') !== 'header,prefix,variable'
+                || typeof auth.variable !== 'string' || !VARIABLE.test(auth.variable) || variables.has(auth.variable)
+                || typeof auth.header !== 'string' || !/^[a-z][a-z0-9-]{0,63}$/.test(auth.header) || FORBIDDEN_HEADERS.has(auth.header)
+                || /^(?:proxy-|x-forwarded-|sec-)/.test(auth.header) || headers.has(auth.header)
+                || typeof auth.prefix !== 'string' || !/^(?:[A-Za-z][A-Za-z0-9_-]{0,31} )?$/.test(auth.prefix))
+                throw invalid();
+            const marker = item.markers[auth.variable];
+            if (typeof marker !== 'string' || !TOKEN.test(marker) || value.target_phases.runtime[auth.variable] !== marker
+                || Object.hasOwn(value.target_phases.build, auth.variable))
+                throw invalid();
+            variables.add(auth.variable);
+            headers.add(auth.header);
+            names.push(auth.variable);
+        }
+        names.sort();
+        if (canonical(item.credential_variables) !== canonical(names) || canonical(Object.keys(item.markers).sort()) !== canonical(names))
+            throw invalid();
+        const routes = new Set();
+        for (const route of item.routes) {
+            if (!record(route) || !['http', 'mcp'].includes(String(route.protocol))
+                || Object.keys(route).sort().join(',') !== (route.protocol === 'mcp' ? 'input_schema,mcp_tool,mcp_url_mode,method,operation,output_schema,protocol,route' : 'method,operation,protocol,route')
+                || typeof route.operation !== 'string' || !route.operation.length || route.operation.length > 255 || route.operation.includes('\0')
+                || typeof route.method !== 'string' || !['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'].includes(route.method)
+                || typeof route.route !== 'string' || route.route.length > 2048 || !/^\/[A-Za-z0-9_./{}~:-]*$/.test(route.route)
+                || route.route.startsWith('//') || route.route.split('/').some(part => part === '.' || part === '..'
+                || (part.includes('{') || part.includes('}')) && !/^\{[A-Za-z_][A-Za-z0-9_]*\}$/.test(part)))
+                throw invalid();
+            if (route.protocol === 'mcp' && (route.method !== 'POST' || typeof route.mcp_tool !== 'string' || !route.mcp_tool.length || route.mcp_tool.length > 255
+                || !['base', 'endpoint'].includes(String(route.mcp_url_mode)) || !record(route.input_schema)
+                || route.output_schema !== null && !record(route.output_schema) || !/^\/(?:[A-Za-z0-9_~.-]+\/?)*$/.test(route.route)))
+                throw invalid();
+            const key = route.protocol + ':' + route.method + ':' + route.route.replace(/\{[A-Za-z_][A-Za-z0-9_]*\}/g, '{}') + (route.protocol === 'mcp' ? ':' + route.mcp_tool : '');
+            if (routes.has(key))
+                throw invalid();
+            routes.add(key);
+        }
+        identifiers.add(item.id);
+        services.add(item.service_key);
+        projected.push(Object.fromEntries(['id', 'service_key', 'endpoint_variable', 'authentication', 'base_path', 'routes'].map(key => [key, item[key]])));
+    }
+    if (canonical([...services].sort()) !== canonical(expected.sort()) || services.size !== expected.length
+        || canonical(projected) !== canonical(control.dependency_bindings.real_channels))
+        throw invalid();
+}
+function validate(value, owner, inputs) {
+    if (!record(value) || !localConfigurationIdentityMatches(value, owner) || value.job_id !== owner.job
+        || value.attempt_id !== owner.attempt || value.lease_id !== owner.lease || value.operation_id !== owner.lease
+        || value.manifest_sha256 !== inputs.manifestSha256 || value.configuration_digest !== owner.configurationDigest
+        || value.provenance !== 'customer_device' || !record(value.control) || !record(value.target_phases)
+        || !Array.isArray(value.model_channels) || !Array.isArray(value.real_channels))
+        throw invalid();
+    const issued = Date.parse(String(value.issued_at)), expires = Date.parse(String(value.lease_expires_at)), deadline = Date.parse(String(value.job_deadline_at));
+    if (![issued, expires, deadline].every(Number.isSafeInteger) || expires <= issued || deadline <= issued)
+        throw invalid();
+    const control = value.control;
+    if (!Array.isArray(control.secret_variable_names)
+        || control.secret_variable_names.some(name => typeof name !== 'string' || !VARIABLE.test(name))
+        || new Set(control.secret_variable_names).size !== control.secret_variable_names.length)
+        throw invalid();
+    const entry = (part) => inputs.manifest.entries.find(item => item.part === part);
+    if (control.job_id !== owner.job || control.operation_id !== owner.lease || control.source_sha256 !== entry('source')?.sha256
+        || typeof control.engine_source_digest !== 'string'
+        || !HASH.test(control.engine_source_digest) || control.cpu_units !== owner.limits.cpu_units || control.memory_mb !== owner.limits.memory_mb
+        || !Number.isSafeInteger(control.budget_seconds) || Number(control.budget_seconds) < 1
+        || Number(control.budget_seconds) > Math.floor((deadline - issued) / 1000) + 1
+        || !record(control.package_inputs) || control.package_inputs.profile !== 'public-locked-packages'
+        || control.package_inputs.sha256 !== entry('packages')?.sha256 || !Number.isSafeInteger(control.package_inputs.max_bytes)
+        || Number(control.package_inputs.max_bytes) < (entry('packages')?.size ?? Infinity)
+        || !record(control.dependency_bindings)
+        || control.dependency_bindings.schema !== 'firedrill.native-binding-policy.v1' || control.dependency_bindings.world_id !== owner.world
+        || control.dependency_bindings.configuration_digest !== owner.configurationDigest)
+        throw invalid();
+    if (!Array.isArray(control.dependency_bindings.dependencies))
+        throw invalid();
+    const hasCatalog = control.dependency_bindings.dependencies.some(choice => record(choice) && record(choice.policy) && choice.policy.catalog !== undefined && choice.policy.catalog !== null);
+    if (hasCatalog && owner.catalogPackagesToDevice !== true) {
+        throw new CliError('local_grant_consent_required', 'This device permission does not allow the selected private tool package download. Review local authorization before continuing.');
+    }
+    if (owner.purpose === 'validation' && hasCatalog) {
+        const input = control.catalog_inputs;
+        if (!record(input) || Object.keys(input).sort().join(',') !== 'sha256,size'
+            || typeof input.sha256 !== 'string' || !HASH.test(input.sha256)
+            || !Number.isSafeInteger(input.size) || Number(input.size) < 1 || Number(input.size) > 128 * 1024 ** 2)
+            throw invalid();
+    }
+    else if (control.catalog_inputs !== undefined)
+        throw invalid();
+    if (owner.purpose !== 'world_session' && (value.world_session !== undefined
+        || control.source_snapshot_id !== owner.sourceSnapshot || control.source_revision !== owner.sourceRevision
+        || !record(control.scenario_inputs) || control.scenario_inputs.sha256 !== entry('scenarios')?.sha256
+        || control.scenario_inputs.size !== entry('scenarios')?.size || typeof control.scenario_inputs.selection_sha256 !== 'string'
+        || !HASH.test(control.scenario_inputs.selection_sha256)))
+        throw invalid();
+    if (owner.purpose === 'world_session') {
+        const packetFields = ['schema', 'actor_id', 'workspace_id', 'native_session_id', 'device_key', 'request_key', 'job_id', 'attempt_id', 'lease_id', 'operation_id', 'manifest_sha256', 'configuration_digest',
+            'provenance', 'issued_at', 'lease_expires_at', 'job_deadline_at', 'control', 'target_phases', 'model_channels',
+            'real_channels', 'participant_channel', 'voice_channels', 'world_session', 'local_values'];
+        const fields = ['schema', 'purpose', 'operation_id', 'job_id', 'session_id', 'world_id', 'configuration_id', 'configuration_digest',
+            'source_sha256', 'engine_source_digest', 'validation_sha256', 'bundle_digest', 'retained_scenario_selection_sha256', 'validation_scope',
+            'dependency_bindings', 'package_inputs', 'target_model_channels', 'secret_variable_names', 'budget_seconds', 'expires_at',
+            'network_policy', 'cpu_units', 'memory_mb', 'state_observation_max_bytes', 'evidence_context_sha256', 'initial_checkpoint', 'dataset', 'dataset_transfer', 'application_checkpoint'];
+        const real = control.validation_scope === 'target_startup_only';
+        if (real)
+            fields.push('startup_authorization_sha256', 'external_effects_sha256');
+        if (Object.keys(value).sort().join(',') !== packetFields.sort().join(',')
+            || Object.keys(control).sort().join(',') !== fields.sort().join(',') || !record(value.world_session)
+            || canonical(value.world_session) !== canonical(owner.session)
+            || control.schema !== 'firedrill.world-session.v1' || control.purpose !== 'world_inspection_session'
+            || control.session_id !== owner.session.session_id || control.configuration_id !== owner.session.configuration_id
+            || control.world_id !== owner.world || control.configuration_digest !== owner.configurationDigest
+            || control.dependency_bindings.configuration_id !== owner.session.configuration_id
+            || control.expires_at !== owner.session.expires_at || Date.parse(owner.session.expires_at) !== deadline
+            || typeof owner.session.input_sha256 !== 'string' || !HASH.test(owner.session.input_sha256)
+            || control.validation_sha256 !== entry('compiled')?.sha256
+            || typeof control.bundle_digest !== 'string' || !/^sha256:[a-f0-9]{64}$/.test(control.bundle_digest)
+            || typeof control.retained_scenario_selection_sha256 !== 'string' || !HASH.test(control.retained_scenario_selection_sha256)
+            || typeof control.evidence_context_sha256 !== 'string' || !HASH.test(control.evidence_context_sha256)
+            || !Number.isSafeInteger(control.state_observation_max_bytes) || Number(control.state_observation_max_bytes) < 1
+            || Number(control.state_observation_max_bytes) > 512 * 1024 ** 2
+            || !Array.isArray(control.secret_variable_names) || control.secret_variable_names.some(name => typeof name !== 'string' || !VARIABLE.test(name))
+            || new Set(control.secret_variable_names).size !== control.secret_variable_names.length
+            || value.participant_channel !== null
+            || (real ? !value.real_channels.length || owner.realAccountAccess !== true
+                || typeof control.startup_authorization_sha256 !== 'string' || !HASH.test(control.startup_authorization_sha256)
+                || typeof control.external_effects_sha256 !== 'string' || !HASH.test(control.external_effects_sha256)
+                : control.validation_scope !== 'native_runtime_and_scenario_preconditions' || value.real_channels.length > 0
+                    || control.startup_authorization_sha256 !== undefined || control.external_effects_sha256 !== undefined))
+            throw invalid();
+        const checkpoint = control.initial_checkpoint, saved = entry('checkpoint');
+        const application = control.application_checkpoint, applicationFile = entry('application_checkpoint');
+        if (application === null ? !!applicationFile : !applicationStateReference(application) || !applicationFile
+            || application.size !== applicationFile.size || application.sha256 !== applicationFile.sha256 || real)
+            throw invalid();
+        if (checkpoint === null) {
+            if (saved)
+                throw invalid();
+        }
+        else {
+            if (!record(checkpoint) || Object.keys(checkpoint).sort().join(',') !== 'archive_id,checkpoint_id,checkpoint_session_id,clock_mode,generation,schema_sha256,scope,sha256,size'
+                || control.dataset !== null || !saved || checkpoint.size !== saved.size || checkpoint.sha256 !== saved.sha256
+                || !Number.isSafeInteger(checkpoint.size) || Number(checkpoint.size) < 1 || Number(checkpoint.size) > Number(control.state_observation_max_bytes)
+                || typeof checkpoint.sha256 !== 'string' || !HASH.test(checkpoint.sha256)
+                || typeof checkpoint.schema_sha256 !== 'string' || !HASH.test(checkpoint.schema_sha256) || typeof checkpoint.generation !== 'string'
+                || !/^[1-9][0-9]{0,30}$/.test(checkpoint.generation) || typeof checkpoint.clock_mode !== 'string'
+                || !['wall', 'not_configured'].includes(checkpoint.clock_mode)
+                || typeof checkpoint.scope !== 'string' || !Object.hasOwn(checkpointResetBaselines, checkpoint.scope)
+                || checkpoint.scope !== 'owned_postgres_rows_sequences_and_sql_clock' && checkpoint.clock_mode !== 'not_configured')
+                throw invalid();
+            for (const name of ['checkpoint_id', 'checkpoint_session_id', 'archive_id']) {
+                if (typeof checkpoint[name] !== 'string' || identifier(checkpoint[name]) !== checkpoint[name])
+                    throw invalid();
+            }
+        }
+        startingData(control, owner, inputs);
+    }
+    else if (owner.purpose === 'validation') {
+        if (control.schema !== 'firedrill.validation.v1' || control.purpose !== 'world_validation'
+            || control.candidate_sha256 !== entry('candidate')?.sha256 || value.participant_channel !== null)
+            throw invalid();
+        const startup = control.validation_scope === 'target_startup_only';
+        if (startup ? !value.real_channels.length || owner.realAccountAccess !== true
+            || typeof control.startup_authorization_sha256 !== 'string' || !HASH.test(control.startup_authorization_sha256)
+            : control.validation_scope !== undefined || control.startup_authorization_sha256 !== undefined || value.real_channels.length > 0)
+            throw invalid();
+    }
+    else {
+        if (owner.purpose !== 'trial' || control.schema !== 'firedrill.trial.v1' || control.purpose !== 'simulation_trial'
+            || control.world_continuity !== undefined && control.world_continuity !== null && control.world_continuity !== 'continuous'
+            || !Number.isSafeInteger(control.trial_seconds) || Number(control.trial_seconds) < 1 || Number(control.trial_seconds) > 2147483647
+            || control.job_deadline_at !== value.job_deadline_at || deadline <= Date.now()
+            || typeof control.invocation_mode !== 'string' || !['conversation', 'single_request', 'browser_chat', 'voice'].includes(control.invocation_mode)
+            || control.validation_sha256 !== entry('compiled')?.sha256 || control.scenario_count !== 1
+            || !Number.isSafeInteger(control.attempt_number) || Number(control.attempt_number) < 1
+            || typeof control.execution_id !== 'string' || identifier(control.execution_id) !== control.execution_id
+            || typeof control.execution_inputs_sha256 !== 'string' || !HASH.test(control.execution_inputs_sha256)
+            || typeof control.scenario_key !== 'string' || !control.scenario_key.length || control.scenario_key.length > 255
+            || typeof control.bundle_digest !== 'string' || !/^sha256:[a-f0-9]{64}$/.test(control.bundle_digest))
+            throw invalid();
+        const driver = control.execution_driver;
+        if (driver !== null && !executionDriverMatches(driver)
+            || !executionAuthorityMatches(control.execution_authority, driver)
+            || (driver === null ? control.execution_basis !== null
+                : !driverBasisMatches(control.execution_basis) || canonical(control.execution_basis) !== canonical(driver.basis))
+            || driver?.requires_input && value.real_channels.length > 0)
+            throw invalid();
+        startingData(control, owner, inputs);
+        const capture = control.browser_capture;
+        const audio = control.voice_capture;
+        const desktop = control.desktop_session, desktopCapture = control.desktop_capture;
+        if (desktop !== null && (!record(desktop) || Object.keys(desktop).sort().join(',') !== 'capability,height,kind,redactions,width'
+            || desktop.kind !== 'rfb_3_8' || typeof desktop.capability !== 'string' || !/^[a-z0-9][a-z0-9_-]{0,127}$/.test(desktop.capability)
+            || !Number.isSafeInteger(desktop.width) || Number(desktop.width) < 320 || Number(desktop.width) > 1920
+            || !Number.isSafeInteger(desktop.height) || Number(desktop.height) < 240 || Number(desktop.height) > 1080
+            || !Array.isArray(desktop.redactions) || desktop.redactions.length > 128
+            || desktop.redactions.some(rect => !record(rect) || Object.keys(rect).sort().join(',') !== 'height,width,x,y'
+                || !['x', 'y', 'width', 'height'].every(key => Number.isSafeInteger(rect[key]))
+                || Number(rect.x) < 0 || Number(rect.y) < 0 || Number(rect.width) < 1 || Number(rect.height) < 1
+                || Number(rect.x) + Number(rect.width) > Number(desktop.width) || Number(rect.y) + Number(rect.height) > Number(desktop.height))))
+            throw invalid();
+        if (!record(desktopCapture) || Object.keys(desktopCapture).sort().join(',') !== 'acknowledge_screen_content,enabled,interval_ms,mask,schema,scope'
+            || desktopCapture.schema !== 'firedrill.desktop-visual-policy.v1' || typeof desktopCapture.enabled !== 'boolean'
+            || desktopCapture.acknowledge_screen_content !== desktopCapture.enabled || desktopCapture.scope !== 'private_synthetic_world'
+            || desktopCapture.mask !== 'declared-regions-and-text-audit.v1' || desktopCapture.interval_ms !== 2000
+            || desktopCapture.enabled && (desktop === null || value.real_channels.length > 0 || control.invocation_mode === 'browser_chat'
+                || !record(capture) || capture.enabled !== false))
+            throw invalid();
+        const voice = control.invocation_mode === 'voice';
+        if (voice) {
+            voiceSession(control.voice_session);
+            if (!Number.isSafeInteger(control.voice_seconds) || Number(control.voice_seconds) < 1 || Number(control.voice_seconds) > 2147483647
+                || control.voice_seconds !== control.trial_seconds
+                || Number(control.voice_seconds) + 90 > Number(control.budget_seconds) || value.real_channels.length > 0)
+                throw invalid();
+        }
+        else if (control.voice_session !== undefined || control.voice_seconds !== undefined)
+            throw invalid();
+        if (!record(audio) || Object.keys(audio).sort().join(',') !== 'enabled,redaction,schema,scope'
+            || audio.schema !== 'firedrill.voice-capture-policy.v1' || typeof audio.enabled !== 'boolean'
+            || audio.enabled && (!voice || value.real_channels.length > 0)
+            || audio.scope !== 'private_synthetic_room' || audio.redaction !== 'none')
+            throw invalid();
+        const session = control.browser_session;
+        if (session !== null && (!record(session) || Object.keys(session).sort().join(',') !== 'capability,height,kind,width'
+            || session.kind !== 'chromium_cdp' || typeof session.capability !== 'string'
+            || !/^[a-z0-9][a-z0-9_-]{0,127}$/.test(session.capability)
+            || !Number.isSafeInteger(session.width) || Number(session.width) < 320 || Number(session.width) > 1920
+            || !Number.isSafeInteger(session.height) || Number(session.height) < 240 || Number(session.height) > 1080
+            || control.invocation_mode === 'browser_chat'))
+            throw invalid();
+        if (!record(capture) || Object.keys(capture).sort().join(',') !== 'enabled,interval_ms,mask,mask_form_values,schema'
+            || capture.schema !== 'firedrill.browser-visual-policy.v2' || typeof capture.enabled !== 'boolean'
+            || typeof capture.mask_form_values !== 'boolean'
+            || capture.mask !== (capture.mask_form_values ? 'form-values-and-sensitive-opaque-dom.v1' : 'sensitive-and-opaque-dom.v1') || capture.interval_ms !== 2000
+            || capture.enabled && (control.invocation_mode !== 'browser_chat' && session === null
+                && !['browser_workflow', 'adaptive_browser'].includes(driver?.kind ?? '') || value.real_channels.length > 0))
+            throw invalid();
+        const startup = control.validation_scope === 'target_startup_only';
+        const continuation = control.application_continuation, applicationFile = entry('application_checkpoint'), nativeFile = entry('checkpoint');
+        if (continuation === null) {
+            if (applicationFile || nativeFile)
+                throw invalid();
+        }
+        else {
+            const paired = record(continuation) && continuation.schema === 'firedrill.application-continuation.v2';
+            if (!record(continuation) || Object.keys(continuation).sort().join(',') !== (paired
+                ? 'acknowledged,barrier,checkpoint,dependencies,schema,world_checkpoint' : 'acknowledged,checkpoint,dependencies,schema')
+                || continuation.schema !== (paired ? 'firedrill.application-continuation.v2' : 'firedrill.application-continuation.v1')
+                || continuation.dependencies !== (paired ? 'coordinated_native_checkpoint' : 'fresh_prepared_state')
+                || continuation.acknowledged !== true || !applicationStateReference(continuation.checkpoint) || !applicationFile
+                || continuation.checkpoint.size !== applicationFile.size || continuation.checkpoint.sha256 !== applicationFile.sha256
+                || control.dataset !== null || startup || value.real_channels.length > 0)
+                throw invalid();
+            if (paired) {
+                const native = continuation.world_checkpoint, barrier = continuation.barrier;
+                if (control.world_id !== owner.world || control.configuration_digest !== owner.configurationDigest
+                    || control.configuration_digest !== value.configuration_digest || typeof control.configuration_id !== 'string'
+                    || identifier(control.configuration_id) !== control.configuration_id || control.configuration_id !== control.dependency_bindings.configuration_id
+                    || !Number.isSafeInteger(control.state_observation_max_bytes) || Number(control.state_observation_max_bytes) < 1
+                    || Number(control.state_observation_max_bytes) > 512 * 1024 ** 2
+                    || !record(native) || Object.keys(native).sort().join(',') !== 'archive_id,checkpoint_id,checkpoint_session_id,clock_mode,generation,schema_sha256,scope,sha256,size'
+                    || !nativeFile || native.size !== nativeFile.size || native.sha256 !== nativeFile.sha256
+                    || !Number.isSafeInteger(native.size) || Number(native.size) < 1 || Number(native.size) > 512 * 1024 ** 2
+                    || Number(native.size) > Number(control.state_observation_max_bytes)
+                    || typeof native.sha256 !== 'string' || !HASH.test(native.sha256) || typeof native.schema_sha256 !== 'string' || !HASH.test(native.schema_sha256)
+                    || typeof native.generation !== 'string' || !/^[1-9][0-9]{0,30}$/.test(native.generation)
+                    || native.checkpoint_id !== continuation.checkpoint.checkpoint_id || native.checkpoint_session_id !== continuation.checkpoint.checkpoint_session_id
+                    || typeof native.archive_id !== 'string' || identifier(native.archive_id) !== native.archive_id
+                    || typeof native.scope !== 'string' || !Object.hasOwn(checkpointResetBaselines, native.scope)
+                    || !['wall', 'not_configured'].includes(String(native.clock_mode))
+                    || native.scope !== 'owned_postgres_rows_sequences_and_sql_clock' && native.clock_mode !== 'not_configured'
+                    || !record(barrier) || Object.keys(barrier).sort().join(',') !== 'event_watermark,request_id'
+                    || barrier.request_id !== native.checkpoint_id || barrier.event_watermark !== continuation.checkpoint.event_watermark)
+                    throw invalid();
+            }
+            else if (nativeFile)
+                throw invalid();
+        }
+        if (typeof control.retained_scenario_selection_sha256 !== 'string' || !HASH.test(control.retained_scenario_selection_sha256)
+            || (startup ? !value.real_channels.length || owner.realAccountAccess !== true
+                || typeof control.startup_authorization_sha256 !== 'string' || !HASH.test(control.startup_authorization_sha256)
+                || typeof control.external_effects_sha256 !== 'string' || !HASH.test(control.external_effects_sha256)
+                : control.validation_scope !== 'native_runtime_and_scenario_preconditions' || value.real_channels.length > 0
+                    || control.startup_authorization_sha256 !== undefined || control.external_effects_sha256 !== undefined))
+            throw invalid();
+        const participant = value.participant_channel;
+        if (control.invocation_mode === 'single_request' && !driver?.uses_participant_model || voice) {
+            if (participant !== null)
+                throw invalid();
+        }
+        else {
+            if (!record(participant) || Object.keys(participant).sort().join(',') !== 'endpoint,model,role,token'
+                || participant.role !== 'participant' || typeof participant.model !== 'string'
+                || !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/.test(participant.model)
+                || typeof participant.token !== 'string' || !/^[A-Za-z0-9_-]{32,256}$/.test(participant.token)
+                || typeof participant.endpoint !== 'string')
+                throw invalid();
+            const endpoint = new URL(participant.endpoint);
+            if (endpoint.origin !== API_ORIGIN || endpoint.username || endpoint.password || endpoint.search || endpoint.hash
+                || !/^\/api\/internal\/model\/[a-f0-9-]{36}$/.test(endpoint.pathname))
+                throw invalid();
+            identifier(endpoint.pathname.split('/').at(-1));
+        }
+    }
+    voiceChannels(value.voice_channels, owner.purpose === 'trial' && control.invocation_mode === 'voice');
+    if (value.target_phases.schema !== 'firedrill.target-phases.v1'
+        || Object.keys(value.target_phases).sort().join(',') !== 'build,runtime,schema')
+        throw invalid();
+    for (const phase of ['build', 'runtime']) {
+        const values = value.target_phases[phase];
+        if (!record(values) || Object.entries(values).some(([name, item]) => !VARIABLE.test(name)
+            || typeof item !== 'string' || item.includes('\0') || Buffer.byteLength(item) > 65536))
+            throw invalid();
+    }
+    const bindings = new Set(), variables = new Set();
+    const projected = [];
+    for (const item of value.model_channels) {
+        if (!record(item) || typeof item.binding_id !== 'string' || identifier(item.binding_id) !== item.binding_id || bindings.has(item.binding_id)
+            || !['anthropic', 'openai'].includes(String(item.provider)) || !Array.isArray(item.models) || !item.models.length
+            || item.models.some(model => typeof model !== 'string' || !model.length || model.length > 256 || /[\x00-\x1f\x7f]/.test(model))
+            || typeof item.key_variable !== 'string' || !VARIABLE.test(item.key_variable)
+            || typeof item.base_url_variable !== 'string' || !VARIABLE.test(item.base_url_variable) || item.key_variable === item.base_url_variable
+            || typeof item.token !== 'string' || !/^[A-Za-z0-9_-]{32,256}$/.test(item.token)
+            || typeof item.endpoint !== 'string' || !Array.isArray(item.phases) || !item.phases.length
+            || item.phases.some(phase => phase !== 'build' && phase !== 'runtime') || new Set(item.phases).size !== item.phases.length)
+            throw invalid();
+        if (variables.has(item.key_variable) || variables.has(item.base_url_variable))
+            throw invalid();
+        variables.add(item.key_variable);
+        variables.add(item.base_url_variable);
+        const endpoint = new URL(item.endpoint);
+        if (endpoint.origin !== API_ORIGIN || endpoint.username || endpoint.password || endpoint.search || endpoint.hash
+            || !/^\/api\/internal\/target-model\/[a-f0-9-]{36}$/.test(endpoint.pathname))
+            throw invalid();
+        identifier(endpoint.pathname.split('/').at(-1));
+        for (const phase of item.phases) {
+            const values = value.target_phases[phase];
+            if (values[item.key_variable] !== item.token || Object.hasOwn(values, item.base_url_variable))
+                throw invalid();
+        }
+        bindings.add(item.binding_id);
+        projected.push(Object.fromEntries(Object.entries(item).filter(([key]) => key !== 'endpoint' && key !== 'token')));
+    }
+    validateRealChannels(value, owner, variables);
+    if (canonical(control.target_model_channels) !== canonical(projected)
+        || control.network_policy !== (owner.purpose === 'world_session' ? 'isolated_world_session' : owner.purpose === 'trial' ? 'managed_trial'
+            : control.validation_scope === 'target_startup_only' ? 'scoped_real_startup'
+                : bindings.size ? 'scoped_model_native_preconditions' : 'offline_native_preconditions'))
+        throw invalid();
+}
+/** Transient private input for the selected executor. Never print or journal. */
+export async function receiveRuntimeConfiguration(owner, inputs, signal) {
+    const prefix = `/api/workspaces/${identifier(owner.workspace)}/local-runners/${identifier(owner.device)}/jobs/${identifier(owner.job)}/claims/${identifier(owner.request)}`;
+    const auth = { actor: owner.owner, workspace: owner.workspace, signal };
+    if (createHash('sha256').update(canonical(inputs.manifest)).digest('hex') !== inputs.manifestSha256)
+        throw invalid();
+    const receipt = await readLocalClaim({ owner: owner.owner, workspace: owner.workspace, world: owner.world }, owner.device, owner.job, owner.request, signal);
+    if (receipt.job_id !== owner.job || receipt.grant_id !== owner.grant || receipt.device_key !== owner.device || receipt.native_session_id !== owner.nativeSession
+        || receipt.purpose !== owner.purpose || (owner.purpose === 'world_session'
+        ? canonical(receipt.world_session) !== canonical(owner.session) : receipt.world_session !== undefined)
+        || receipt.payload_digest !== owner.payloadDigest || receipt.claim?.id !== owner.lease
+        || receipt.claim.request_key !== owner.request || receipt.claim.attempt_id !== owner.attempt || receipt.claim.state !== 'claimed')
+        throw invalid();
+    const sent = Date.parse(receipt.server_time);
+    if (!Number.isSafeInteger(sent) || Date.parse(receipt.claim.expires_at) <= sent)
+        throw invalid();
+    const payload = { schema: 'firedrill.local-runtime-read.v1', request_key: owner.request,
+        job_id: owner.job, device_key: owner.device, native_session_id: owner.nativeSession, lease_id: owner.lease,
+        manifest_sha256: inputs.manifestSha256, read_key: randomUUID(), sent_at_ms: sent };
+    const signed = await signRunnerRequest(owner, owner.device, payload, signal);
+    const value = await api(prefix + '/runtime-configuration', { ...auth, method: 'POST', body: signed });
+    try {
+        validate(value, owner, inputs);
+        await resolveLocalValues(owner, value.local_values, value.target_phases, value.control.secret_variable_names);
+        return value;
+    }
+    catch {
+        clearRuntimeConfiguration(value);
+        throw invalid();
+    }
+}