forgeos 0.1.0-alpha.64 → 0.1.0-alpha.66

package/AGENTS.md

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.64 input=5bea3de626e4a7db3a5bbe226a820619b19a6e1347922b0a4f97fedf6654c489 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
+// @forge-generated generator=0.1.0-alpha.66 input=57341432921f2c43eddb033a05cc7ad25dabd9813fcf2fd64c67f74ae5f61859 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
 # AGENTS.md
 
 <!-- forge-generated:start -->

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # forgeos
 
+## 0.1.0-alpha.66
+
+### Patch Changes
+
+- [#66](https://github.com/Stahldavid/forge/pull/66) [`472cde3`](https://github.com/Stahldavid/forge/commit/472cde3647cf055afd627460bf015ab5467ab8d5) Thanks [@Stahldavid](https://github.com/Stahldavid)! - Add a local Agent Fabric change-review flow for Codex App authored diffs. It
+  captures an exact staged, unstaged, and new-file snapshot, runs a bounded
+  read-only Codex CLI reviewer on an isolated checkout, and keeps digest-bound
+  review rounds and findings. CLI and MCP expose proposal and evidence while
+  reviewer dispatch remains an explicit CLI action.
+
+## 0.1.0-alpha.65
+
+### Patch Changes
+
+- [#61](https://github.com/Stahldavid/forge/pull/61) [`6fb76d7`](https://github.com/Stahldavid/forge/commit/6fb76d734257d96d1d366528848801cbd3698395) Thanks [@Stahldavid](https://github.com/Stahldavid)! - Harden the single-owner Agent Fabric CLI and MCP pilot with durable patch and
+  verification receipts, owner-controlled source-grounded memory, guarded local
+  effects, a fixed two-worker harness, and a local Evolution Registry. Improve
+  Codex hook ingestion, Studio startup, release propagation checks, and targeted
+  CI coverage.
+
 ## 0.1.0-alpha.64
 
 ### Minor Changes

package/docs/agent-fabric.md

@@ -14,15 +14,71 @@ control journal, browser-based owner review, an isolated Ollama coding worker,
 and MCP proposal/status tools backed by a local owner process. It does not make
 a production persistence or security claim. Its scope and remaining gates are
 in [`P0B_B_LOCAL_CODING_SCOPE.md`](./architecture/agent-fabric/P0B_B_LOCAL_CODING_SCOPE.md).
+The [single-owner acceptance matrix](./architecture/agent-fabric/LOCAL_SINGLE_OWNER_ACCEPTANCE.md)
+separates the current local implementation from its remaining release and human
+acceptance gates.
+Owner-selected local memory, fixed two-process data workers, and a standalone
+Evolution Registry have separate narrow workflows below. These do not grant
+the Ollama coding worker new tools or executable extensions.
+
+`LocalAdaptiveHarness.run()` is a fixed local demonstration of two permitted
+Node processes (`inventory` and `constraints`) followed by an authoritative
+join. Each child receives only bounded text on stdin, an empty environment,
+and a one second wall limit. The coordinator validates each digest against its
+own input before committing the P0a result; cancellation, timeout, or an
+invalid report leaves the join blocked. This trusted data worker is not an
+arbitrary coding agent or an OS security sandbox.
+
+The single-PC CLI wraps that harness with a local owner decision and durable
+readback. From the repository root, create a JSON file with exactly two fields,
+for example `{"inventory":"src/a.ts","constraints":"read only"}`. Each field
+is data of at most 256 UTF-8 bytes. Then run:
+
+```bash
+node bin/forge.mjs fabric adaptive-propose --file input.json --json
+node bin/forge.mjs fabric adaptive-review <run-id> --json
+node bin/forge.mjs fabric adaptive-run <run-id> --json
+node bin/forge.mjs fabric adaptive-status <run-id> --json
+```
+
+To narrow the two data fields through an owner-selected Evolution profile,
+pass `--channel canary` or `--channel stable` to `adaptive-propose` after that
+channel has a selected `local-adaptive-input-profile` version. The proposal
+binds the immutable version ID before review. The owner window displays it,
+and `adaptive-run` checks that the same version remains selected and loadable
+before issuing permits. A changed or revoked selection blocks the run. The
+profile validates labels and lengths only; it does not provide code, tools,
+instructions, or worker behavior.
+Profile decisions and an adaptive run share a local process lock, so a
+promotion or revocation cannot race between profile readback and worker dispatch.
+
+`adaptive-review` opens a loopback browser window showing both exact inputs,
+the bound profile version when present, and their proposal digest. The approval
+expires after five minutes and permits one run. The
+CLI commits the owner authorization, fixed plan, child grants, and both P0a
+permits to a separate local PGlite journal before starting either process.
+The result record and authoritative join can be read after closing and
+reopening the CLI. If the process dies after committing the join but before
+saving the result record, status still reports the authoritative join but may
+omit process IDs and child details. A run cannot be repeated; a crash after
+dispatch is shown as uncertain unless the durable journal contains the join.
+Cancellation, failed workers, or missing results never authorize a join.
+Local records and the owner verifier key live under `.forge/local/agent-fabric`.
+The local owner lock prevents concurrent mutating CLI invocations; after a
+crash, inspect `adaptive-status` before any manual lock recovery. This is a
+single-PC workflow, not a production security or multi-host claim.
 
 The following remain explicitly deferred and must not be inferred from architecture notes, historical handoffs, or local experiments:
 
-- model-selected tools, plugins or child delegation beyond P0b-A;
+- model-selected tools, plugins or child delegation (the local data workers use
+  fixed code-owned child permits only);
 - PGlite-backed production persistence/outbox integration for Agent Fabric;
-- consequential-effect brokers and reconciliation against real systems;
+- general consequential-effect brokers and arbitrary external-system effects
+  (the local pilot has fixed patch and Docker verification receipts only);
 - recovery epochs and integrity-unknown recovery;
-- adaptive model routing/harness compilation beyond the P0a contracts;
-- plugin promotion, persistent memory, and governed self-evolution;
+- adaptive model routing and general harness compilation beyond the fixed
+  two-process data workflow;
+- executable plugin promotion, shared production memory, and autonomous self-evolution;
 - production deployment or production security claims.
 
 ## P0a scope
@@ -208,45 +264,192 @@ That public entry point exposes the hardened Conductor and hardened replay funct
 ## Local coding pilot (experimental)
 
 The framework checkout also exposes a bounded single-owner CLI path. Run these commands
-from the root of a trusted Git repository with Ollama running and `qwen3:0.6b`
+from the root of a trusted Git repository with Ollama running and `qwen2.5-coder:3b`
 installed. This pilot uses no hosted API key or Codex model turn.
 
 ```text
 node bin/forge.mjs fabric capabilities --json
 node bin/forge.mjs fabric propose --file task.json --json
+node bin/forge.mjs fabric memory-add --file note.json --json
+node bin/forge.mjs fabric memory-list --file paths.json --json
+node bin/forge.mjs fabric memory-delete <memory-id> --json
 node bin/forge.mjs fabric status <task-id> --json
+node bin/forge.mjs fabric evidence <task-id> --json
 node bin/forge.mjs fabric review <task-id> --json
 node bin/forge.mjs fabric run <task-id> --json
+node bin/forge.mjs fabric cancel <task-id> --json
+node bin/forge.mjs fabric reconcile <task-id> --json
+node bin/forge.mjs fabric verify <task-id> --json
 node bin/forge.mjs fabric review-result <task-id> --json
 node bin/forge.mjs fabric serve --json
 ```
 
 `task.json` is an untrusted proposal. Its required fields are `schemaVersion: 1`,
 `repositoryId`, the full `baseCommit`, `goal`, `acceptanceCriteria`, `nonObjectives`,
-`sourcePaths`, `writablePaths`, `requestedModelTargetId: "target:ollama:local"`, and
+`sourcePaths`, `writablePaths`, `requestedModelTargetId: "target:ollama:local"`,
+`requestedModelId: "qwen2.5-coder:3b"`, and
 `limits` with `maximumAttempts`, `maximumWallClockMs`, `maximumOutputTokens`,
 `maximumContextBytes`, `maximumPatchBytes`, and a Unix millisecond `expiresAt`.
 `review` opens a local browser window showing the exact proposal and digest; `run`
 consumes one approved model attempt and writes a diff in an isolated Git worktree.
+The model ID is part of that digest and appears in the owner review. Existing
+tasks approved before model pinning cannot start a new model call; submit a fresh
+proposal. Their saved outcomes and patches remain available for readback, while
+the exact model for a legacy outcome is reported as unknown.
+The service captures the allowlisted tracked source files at the exact current
+HEAD when proposing and rechecks them before spending the approved model
+attempt. Changed source content or HEAD blocks a stale attempt.
+`cancel` revokes an unused owner approval so `run` cannot start it, including after
+the owner restarts. During an active model call, it requests abort from the
+local adapter. The returned `model_uncertain` state does not prove the provider
+stopped; a dispatched attempt cannot be retried. Cancellation does not stop
+patch materialization or Docker verification that has already started. Start
+`fabric serve` before `run` when you need a second CLI process to cancel an
+in-flight call; a one-shot `run` has no cross-process abort endpoint.
 `review-result` shows the recorded diff for a separate owner decision. Acceptance
 records a decision only; it does not alter the original checkout or merge code.
 
+Private memory is opt in and local to this checkout. `memory-add` reads a JSON
+file such as `{ "sourcePaths": ["src/example.ts"], "text": "Owner note",
+"retentionMs": 86400000 }`; `memory-list` reads a JSON file containing only
+`sourcePaths`. Both require an unchanged tracked source snapshot. Notes are
+bounded to 2 KiB, retained for at most 30 days, and stored under
+`.forge/local/agent-fabric`. `memory-delete` removes a note by its returned ID.
+To select notes for a coding task, add `"memoryIds": ["memory:<id>"]` to
+`task.json` using returned full IDs. The proposal digest binds those IDs; the
+owner review displays their text and provenance. Missing, expired, deleted, or
+source-stale notes block approval or execution. Selected notes consume the
+existing context byte budget and are labeled `untrusted_memory` in the model
+context. MCP task tools cannot add, list, or delete private memory.
+
+An optional `verification` field binds an immutable local Docker image ID and
+two to four bounded command descriptors into the proposal digest. The first
+descriptor is `{ "kind": "git-diff-check", "timeoutMs": 5000 }`; the remaining
+descriptors are `{ "kind": "node-test-file", "path": "pass.test.mjs",
+"timeoutMs": 20000 }`. The owner sees these exact commands and image in the
+approval window. The image ID must match the locally installed `node:22`
+image with a `node@sha256` registry digest; the service rejects a proposal
+pointing to another local image and rechecks the tag before execution.
+Each Node test file must exist in the pinned commit and be outside the task's
+writable paths, so the model cannot replace the test that judges its patch.
+After `run` produces a patch, `verify` checks deterministic test paths,
+mount encoding, Docker context, and the pinned image before recording a durable
+intent. A dispatch barrier is recorded before container execution. The owner
+can clear only an intent that has no dispatch barrier; a potentially started
+container cannot be retried automatically. `git diff --check` runs with external
+diff and filesystem monitor helpers disabled on the host; Node tests run inside
+Docker Desktop without network, with an
+immutable already-installed image, read-only checkout, nonroot user and resource
+limits. Accepting a patch with an approved verification profile requires all
+checks to pass; a failed or uncertain result can still be rejected by the owner.
+
 The local store lives under `.forge/local/agent-fabric` and has one PGlite process
 owner. Start `forge fabric serve` to keep that owner running while separate CLI
 and MCP clients connect through a loopback endpoint. The endpoint token stays in
-the local repository store and is not printed. The MCP tools `fabric_propose` and
-`fabric_status` use that same owner; they cannot approve, run, or accept a task.
+the local repository store and is not printed. The MCP tools `fabric_propose`,
+`fabric_status`, and `fabric_evidence` use that same owner; they cannot approve,
+run, or accept a task. `fabric_evidence` returns a digest-bound provenance summary
+without raw model text or diff content.
 Without a running owner, CLI commands open the store for a single operation and
 MCP task tools report that the owner is unavailable. A crashed model attempt with
 a committed permit and no outcome remains
 uncertain; a repeated `run` does not spend another attempt. A committed model result
-can be materialized after restart. The existing MCP server reports the boundary
+can be materialized after restart if no patch-effect intent was issued. Patch
+materialization records a durable intent before creating the isolated checkout.
+A crash after that intent reports `patch_uncertain`; `run` will not reapply it.
+`fabric reconcile` reads the checkout and diff artifact against the committed
+model result and records a receipt only when they match exactly. It never
+creates or rewrites the patch. The existing MCP server reports the boundary
 through `fabric_capabilities`. The popup is
 a cooperative same-account interaction, so it is not a security boundary against
 an agent with unrestricted shell or UI control. The model receives only approved
 source files and cannot run shell commands. The Git worktree confines patch
-materialization, but it is not a container or VM sandbox.
+materialization; optional Node verification is container isolated. This pilot
+does not yet broker arbitrary consequential effects or attest to sandbox escape
+resistance against a hostile local administrator.
 
 Maintainers can run `bun scripts/agent-fabric-local-smoke.ts` for an opt-in real
 Ollama fixture. That script injects a synthetic test approval and confirms a diff;
 it does not prove the human popup flow or coding quality on real projects.
+`FORGE_FABRIC_DOCKER_SMOKE=1 bun test tests/agent-fabric/local-task-service.test.ts`
+exercises the service, approved verification, Docker Desktop, durable readback,
+and acceptance with a synthetic approval callback.
+
+### Codex App implementation with adversarial review (local preview)
+
+The Codex App may implement a change in the current checkout. Register the work
+before editing with a JSON request such as
+`{"objective":"Change the parser","acceptanceCriteria":["The new case is handled"],"implementer":"codex-app"}`.
+Place the request under the ignored `.forge/local/` directory, then use:
+
+```bash
+node bin/forge.mjs fabric change-propose --file .forge/local/change-request.json --json
+node bin/forge.mjs fabric change-status --task-id <change-id> --json
+node bin/forge.mjs fabric change-review --task-id <change-id> --json
+node bin/forge.mjs fabric change-evidence --task-id <change-id> --json
+```
+
+`change-review` is an explicit owner CLI action that starts a **new Codex CLI
+review turn** using the machine's existing Codex login. That turn may consume
+Codex usage. The MCP tools `fabric_change_propose`, `fabric_change_status`, and
+`fabric_change_evidence` can register and inspect a change but cannot start a
+review or mark it accepted. The request pins the base commit; review later
+captures staged, unstaged, and non-ignored new files without modifying the
+user's Git index. Local Forge state under `.forge/local` and `.forge/delta` is
+excluded. A review is limited to 1 MiB, 100 paths, and eight rounds; binary
+patches, symlinks, and submodules are rejected.
+
+Each round records an immutable diff and request digest before dispatch. The
+reviewer runs against a separate checkout of that exact diff in read-only
+sandbox mode. A valid structured report bound to the request digest is required;
+process exit zero alone is insufficient. `canAccept` becomes true only for a
+passing report on the **current** diff. Editing the checkout after a pass makes
+it `needs_review`, and the next review creates a new round. An interrupted
+review remains uncertain and will not automatically spend another turn. An
+inconclusive completed review may be retried explicitly. For an interrupted
+review, inspect its evidence and create a fresh change request if another paid
+turn is warranted; the uncertain intent remains in the original record.
+`canAccept` is evidence for the human workflow; this preview does not intercept
+Git merges or edits made outside the CLI. Same-account shell access can alter
+the local ledger and is outside the pilot's security boundary. The Codex CLI
+review protocol has fake-process tests but no paid, real-model smoke yet.
+
+### Local Evolution Registry (single owner)
+
+The local extension workflow pins a candidate's bytes before evaluation. A
+manifest is a repository file with exactly these fields:
+
+```json
+{"schemaVersion":1,"extensionKey":"sample","artifactPath":"extensions/sample.js"}
+```
+
+The artifact and manifest must be regular files inside the repository. The
+artifact is limited to 1 MiB and the manifest to 16 KiB. Forge copies both to
+content addressed files under `.forge/local/agent-fabric/evolution/`; edits to
+the source files after registration do not change the registered version.
+
+```bash
+node bin/forge.mjs evolution register --manifest extensions/sample.json --json
+node bin/forge.mjs evolution evaluate extension:sha256:<digest> --json
+node bin/forge.mjs evolution status extension:sha256:<digest> --json
+node bin/forge.mjs evolution review canary extension:sha256:<digest> --json
+node bin/forge.mjs evolution review promote extension:sha256:<digest> --json
+node bin/forge.mjs evolution load sample --channel stable --json
+node bin/forge.mjs evolution review rollback extension:sha256:<older-digest> --json
+node bin/forge.mjs evolution review revoke extension:sha256:<digest> --json
+```
+
+Evaluation is a fixed local suite that checks stored artifact integrity,
+stored manifest integrity, and the manifest contract. It does not execute the
+candidate. Each version evaluates once; a failed or interrupted evaluation
+requires a new candidate version. Canary, promotion, rollback, and revocation
+open a loopback owner review window. Rejection or timeout leaves selection
+unchanged. Rollback can select only a previously stable version that still has
+a passing evaluation. Revocation clears selections and blocks future loading.
+
+The `load` command reports verified metadata. Local runtime callers can use
+`LocalEvolutionService.loadSelected` to obtain bytes after the same channel,
+evaluation, revocation, and digest checks. This registry does not import or
+execute those bytes or grant them side effects. Its review window is a
+cooperative human checkpoint; same-account shell or browser automation is
+outside its protection boundary. No hosted model or API key is used.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeos",
-  "version": "0.1.0-alpha.64",
+  "version": "0.1.0-alpha.66",
   "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
   "type": "module",
   "license": "MIT",

package/src/forge/_generated/releaseManifest.json

@@ -1 +1 @@
-{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.64","releaseId":"forgeos@0.1.0-alpha.64+unknown","schemaVersion":"0.1.0"}
+{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.66","releaseId":"forgeos@0.1.0-alpha.66+unknown","schemaVersion":"0.1.0"}

package/src/forge/_generated/releaseManifest.ts

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.64 input=5bea3de626e4a7db3a5bbe226a820619b19a6e1347922b0a4f97fedf6654c489 content=805acd8e59d13986e509830825226246b9aa99c68f254c7879db5648cec66b9f
+// @forge-generated generator=0.1.0-alpha.66 input=57341432921f2c43eddb033a05cc7ad25dabd9813fcf2fd64c67f74ae5f61859 content=1c305c2f9d3a0ad52157e8b8858790d338296f1d0cc59c0d70f93c65d9c19fc0
 export const releaseManifest = {
   "defaultProvider": "local",
   "diagnostics": [],
@@ -19,7 +19,7 @@ export const releaseManifest = {
     "custom"
   ],
   "packageName": "forgeos",
-  "packageVersion": "0.1.0-alpha.64",
-  "releaseId": "forgeos@0.1.0-alpha.64+unknown",
+  "packageVersion": "0.1.0-alpha.66",
+  "releaseId": "forgeos@0.1.0-alpha.66+unknown",
   "schemaVersion": "0.1.0"
 } as const;

package/src/forge/agent-fabric/codex-adversarial-review.ts

@@ -0,0 +1,229 @@
+import { spawn, type ChildProcessWithoutNullStreams, type SpawnOptionsWithoutStdio } from "node:child_process";
+import { createHash } from "node:crypto";
+import { realpathSync, statSync } from "node:fs";
+import type { Digest } from "./types.ts";
+
+const DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/u;
+const MAX_TIMEOUT_MS = 10 * 60_000;
+const MAX_OUTPUT_BYTES = 2 * 1024 * 1024;
+const MAX_PROMPT_BYTES = 64 * 1024;
+const MAX_FINDINGS = 100;
+
+export interface CodexAdversarialFinding {
+  severity: "blocker" | "high" | "medium" | "low";
+  path: string;
+  line?: number;
+  title: string;
+  explanation: string;
+}
+
+export interface CodexAdversarialReport {
+  requestDigest: Digest;
+  verdict: "pass" | "changes_requested" | "inconclusive";
+  summary: string;
+  findings: readonly CodexAdversarialFinding[];
+}
+
+export interface CodexReviewUsage {
+  inputTokens: number;
+  outputTokens: number;
+  cachedInputTokens?: number;
+}
+
+export type CodexAdversarialReviewResult =
+  | { state: "reported"; report: CodexAdversarialReport; outputDigest: Digest; usage?: CodexReviewUsage }
+  | { state: "inconclusive"; error: string; report?: CodexAdversarialReport; outputDigest?: Digest; usage?: CodexReviewUsage };
+
+export interface CodexAdversarialReviewOptions {
+  /** A prepared, exact review checkout. The caller must verify its Git identity and diff before and after this call. */
+  workspaceRoot: string;
+  /** Canonical digest of the review request and exact diff, supplied by the caller. */
+  requestDigest: Digest;
+  prompt: string;
+  timeoutMs: number;
+  maxOutputBytes: number;
+  executable?: string;
+  signal?: AbortSignal;
+  /** Injection point for tests; production uses node:child_process.spawn. */
+  spawnProcess?: (command: string, args: string[], options: SpawnOptionsWithoutStdio) => ChildProcessWithoutNullStreams;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function exactKeys(value: Record<string, unknown>, required: readonly string[], optional: readonly string[] = []): boolean {
+  return required.every((key) => Object.hasOwn(value, key)) &&
+    Object.keys(value).every((key) => required.includes(key) || optional.includes(key));
+}
+
+function nonEmptyText(value: unknown, maxLength: number): value is string {
+  return typeof value === "string" && value.trim().length > 0 && value.length <= maxLength && !value.includes("\u0000");
+}
+
+function validFinding(value: unknown): value is CodexAdversarialFinding {
+  if (!isRecord(value) || !exactKeys(value, ["severity", "path", "title", "explanation"], ["line"])) return false;
+  if (!["blocker", "high", "medium", "low"].includes(String(value.severity))) return false;
+  if (!nonEmptyText(value.path, 512) || value.path.includes("\\") || value.path.startsWith("/") ||
+      /^[a-z]:/iu.test(value.path) || value.path.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) return false;
+  if (!nonEmptyText(value.title, 500) || !nonEmptyText(value.explanation, 4_000)) return false;
+  return value.line === undefined || (Number.isSafeInteger(value.line) && Number(value.line) > 0);
+}
+
+function parseReport(text: string, requestDigest: Digest): CodexAdversarialReport | undefined {
+  let value: unknown;
+  try { value = JSON.parse(text); } catch { return undefined; }
+  if (!isRecord(value) || !exactKeys(value, ["requestDigest", "verdict", "summary", "findings"])) return undefined;
+  if (value.requestDigest !== requestDigest || !["pass", "changes_requested", "inconclusive"].includes(String(value.verdict)) ||
+      !nonEmptyText(value.summary, 4_000) || !Array.isArray(value.findings) ||
+      value.findings.length > MAX_FINDINGS || !value.findings.every(validFinding)) return undefined;
+  if ((value.verdict === "pass" && value.findings.length !== 0) ||
+      (value.verdict === "changes_requested" && value.findings.length === 0)) return undefined;
+  return value as unknown as CodexAdversarialReport;
+}
+
+function parseUsage(value: unknown): CodexReviewUsage | undefined {
+  if (!isRecord(value)) return undefined;
+  const input = value.input_tokens;
+  const output = value.output_tokens;
+  const cached = value.cached_input_tokens;
+  if (!Number.isSafeInteger(input) || Number(input) < 0 ||
+      !Number.isSafeInteger(output) || Number(output) < 0) return undefined;
+  return {
+    inputTokens: Number(input), outputTokens: Number(output),
+    ...(Number.isSafeInteger(cached) && Number(cached) >= 0 ? { cachedInputTokens: Number(cached) } : {}),
+  };
+}
+
+function parseCodexEvents(stdout: string, requestDigest: Digest):
+  { report?: CodexAdversarialReport; usage?: CodexReviewUsage; error?: string } {
+  let finalText: string | undefined;
+  let usage: CodexReviewUsage | undefined;
+  let completed = false;
+  let failure = false;
+  for (const line of stdout.split(/\r?\n/u)) {
+    if (!line) continue;
+    let event: unknown;
+    try { event = JSON.parse(line); } catch { return { error: "invalid_jsonl" }; }
+    if (!isRecord(event) || typeof event.type !== "string") return { error: "invalid_event" };
+    if (event.type === "item.completed" && isRecord(event.item) && event.item.type === "agent_message") {
+      if (typeof event.item.text !== "string") return { error: "invalid_agent_message" };
+      finalText = event.item.text;
+    }
+    if (event.type === "turn.completed") {
+      completed = true;
+      usage = parseUsage(event.usage);
+    }
+    if (event.type === "turn.failed" || event.type === "error") failure = true;
+  }
+  if (failure) return { error: "codex_turn_failed", usage };
+  if (!completed) return { error: "missing_completed_turn", usage };
+  if (finalText === undefined) return { error: "missing_agent_report", usage };
+  const report = parseReport(finalText, requestDigest);
+  if (!report) return { error: "invalid_agent_report", usage };
+  return { report, usage };
+}
+
+function digestOutput(stdout: Buffer, stderr: Buffer): Digest {
+  const hash = createHash("sha256");
+  hash.update(stdout);
+  hash.update(stderr);
+  return `sha256:${hash.digest("hex")}`;
+}
+
+/** Codex's read-only sandbox is defense in depth; the caller owns checkout isolation and exact-diff verification. */
+export async function runCodexAdversarialReview(options: CodexAdversarialReviewOptions): Promise<CodexAdversarialReviewResult> {
+  if (!DIGEST_PATTERN.test(options.requestDigest) || !nonEmptyText(options.prompt, MAX_PROMPT_BYTES) ||
+      Buffer.byteLength(options.prompt, "utf8") > MAX_PROMPT_BYTES ||
+      !Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > MAX_TIMEOUT_MS ||
+      !Number.isSafeInteger(options.maxOutputBytes) || options.maxOutputBytes < 1 || options.maxOutputBytes > MAX_OUTPUT_BYTES) {
+    throw new TypeError("Invalid Codex review bounds or request");
+  }
+  const workspaceRoot = realpathSync(options.workspaceRoot);
+  if (!statSync(workspaceRoot).isDirectory()) throw new TypeError("Codex review workspace must be a directory");
+  if (options.signal?.aborted) return { state: "inconclusive", error: "cancelled" };
+
+  const args = ["--sandbox", "read-only", "--ask-for-approval", "never", "exec", "review",
+    "--uncommitted", "--json", "--ephemeral", "-"];
+  const prompt = `${options.prompt.trimEnd()}\n\nReturn ONLY a JSON object as the final answer with exactly these keys: ` +
+    `requestDigest, verdict, summary, findings. Set requestDigest to ${options.requestDigest}. ` +
+    `verdict is pass, changes_requested, or inconclusive. Each finding has severity ` +
+    `(blocker, high, medium, low), repository-relative path, optional positive line, title, and explanation. ` +
+    `Use an empty findings array only for pass or inconclusive. Do not use Markdown fences.\n`;
+
+  return await new Promise((resolve) => {
+    let child: ChildProcessWithoutNullStreams;
+    try {
+      child = (options.spawnProcess ?? spawn)(options.executable ?? "codex", args, {
+        cwd: workspaceRoot, shell: false, windowsHide: true, stdio: ["pipe", "pipe", "pipe"],
+      });
+    } catch {
+      resolve({ state: "inconclusive", error: "spawn_failed" });
+      return;
+    }
+
+    const stdout: Buffer[] = [];
+    const stderr: Buffer[] = [];
+    let captured = 0;
+    let reason: string | undefined;
+    let settled = false;
+    let hardTimer: ReturnType<typeof setTimeout> | undefined;
+    const finish = (code: number | null) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (hardTimer) clearTimeout(hardTimer);
+      options.signal?.removeEventListener("abort", cancel);
+      const out = Buffer.concat(stdout);
+      const err = Buffer.concat(stderr);
+      const outputDigest = digestOutput(out, err);
+      if (reason) {
+        resolve({ state: "inconclusive", error: reason, outputDigest });
+        return;
+      }
+      if (code !== 0) {
+        resolve({ state: "inconclusive", error: "codex_nonzero_exit", outputDigest });
+        return;
+      }
+      const parsed = parseCodexEvents(out.toString("utf8"), options.requestDigest);
+      if (!parsed.report) {
+        resolve({ state: "inconclusive", error: parsed.error ?? "invalid_agent_report", outputDigest,
+          ...(parsed.usage ? { usage: parsed.usage } : {}) });
+        return;
+      }
+      if (parsed.report.verdict === "inconclusive") {
+        resolve({ state: "inconclusive", error: "reviewer_inconclusive", report: parsed.report, outputDigest,
+          ...(parsed.usage ? { usage: parsed.usage } : {}) });
+        return;
+      }
+      resolve({ state: "reported", report: parsed.report, outputDigest,
+        ...(parsed.usage ? { usage: parsed.usage } : {}) });
+    };
+    const stop = (why: string) => {
+      if (reason || settled) return;
+      reason = why;
+      child.kill();
+      hardTimer = setTimeout(() => finish(null), 2_000);
+    };
+    const capture = (chunk: Buffer, target: Buffer[]) => {
+      if (reason || settled) return;
+      const remaining = options.maxOutputBytes - captured;
+      if (remaining > 0) {
+        const part = chunk.subarray(0, remaining);
+        target.push(part);
+        captured += part.length;
+      }
+      if (chunk.length > remaining) stop("output_limit");
+    };
+    const cancel = () => stop("cancelled");
+    child.stdout.on("data", (chunk: Buffer) => capture(chunk, stdout));
+    child.stderr.on("data", (chunk: Buffer) => capture(chunk, stderr));
+    child.on("error", () => stop("spawn_failed"));
+    child.on("close", finish);
+    const timer = setTimeout(() => stop("timeout"), options.timeoutMs);
+    options.signal?.addEventListener("abort", cancel, { once: true });
+    if (options.signal?.aborted) cancel();
+    child.stdin.on("error", () => stop("stdin_failed"));
+    try { child.stdin.end(prompt); } catch { stop("stdin_failed"); }
+  });
+}

package/src/forge/agent-fabric/index.ts

@@ -8,6 +8,10 @@ export type {
 } from "./hardened-conductor.ts";
 export * from "./errors.ts";
 export * from "./journal.ts";
+export { LocalEvolutionRegistry } from "./local-evolution-registry.ts";
+export type { ExtensionCandidate, ExtensionVersion, FixedEvaluationSuite, EvaluationRecord,
+  EvolutionChannel, EvolutionDecisionAction, EvolutionVersionStatus, EvolutionOwnerVerifier } from "./local-evolution-registry.ts";
+export { LocalEvolutionService, LOCAL_EVOLUTION_SUITE } from "./local-evolution-service.ts";
 export * from "./p0a.ts";
 export * from "./p0b-model-adapter.ts";
 export * from "./planning.ts";

package/src/forge/agent-fabric/local-adaptive-digest-worker.mjs

@@ -0,0 +1,26 @@
+// Fixed data-only worker. This file deliberately has no Forge imports, tools,
+// filesystem access, or network calls. The coordinator verifies its output.
+import { createHash } from "node:crypto";
+
+let input = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => {
+  input += chunk;
+  if (Buffer.byteLength(input, "utf8") > 1_024) process.exit(2);
+});
+process.stdin.on("end", () => {
+  try {
+    const message = JSON.parse(input);
+    if (!message || Object.keys(message).sort().join(",") !== "input,role" ||
+        !["inventory", "constraints"].includes(message.role) ||
+        typeof message.input !== "string" || message.input.length > 256) {
+      process.exitCode = 2;
+      return;
+    }
+    const canonical = JSON.stringify({ input: message.input, role: message.role });
+    const resultDigest = `sha256:${createHash("sha256").update(canonical).digest("hex")}`;
+    process.stdout.write(JSON.stringify({ pid: process.pid, role: message.role, resultDigest }));
+  } catch {
+    process.exitCode = 2;
+  }
+});