harnery 0.22.0 → 0.23.0

package/dist/core/workflow/workspaces/cleanup.js

@@ -0,0 +1,223 @@
+import { join } from "node:path";
+import { readWorkflowProof } from "../proof.js";
+import { readWorkflowRunManifest } from "../run-state.js";
+import { acquireNoClobberLease } from "./leases.js";
+import { containsPath } from "./paths.js";
+import { appendCleanupAttempt, appendWorkflowJournalEvent, readCleanupAttempts, readWorkflowSupplement, stableDigest, workflowRunDir, writeWorkflowSupplement, } from "./state.js";
+import { isWorkspaceAttestation, isWorkspaceBoundExecutionEvidence } from "./validate.js";
+const CLEANUP_LEASE_STALE_MS = 5 * 60 * 1_000;
+export async function cleanupWorkspace(input) {
+    const release = acquireCleanupLease(input.coordRoot, input.runId);
+    try {
+        return await cleanupWorkspaceUnderLease(input);
+    }
+    finally {
+        release();
+    }
+}
+async function cleanupWorkspaceUnderLease(input) {
+    const manifest = readWorkflowRunManifest(input.coordRoot, input.runId);
+    const proof = readWorkflowProof(input.coordRoot, input.runId);
+    const binding = manifest.execution.workspace_binding;
+    if (!binding ||
+        !isWorkspaceBoundExecutionEvidence(proof.execution, input.runId) ||
+        stableDigest(binding) !== stableDigest(proof.execution.binding)) {
+        throw new Error("workspace cleanup requires matching terminal execution evidence");
+    }
+    assertCleanupPathAuthority(binding, manifest.execution.policy?.allowed_paths ?? []);
+    const mode = input.mode ?? "normal";
+    const current = await input.provider.attest(binding);
+    if (!isWorkspaceAttestation(current, binding)) {
+        throw new Error("workspace cleanup provider returned an invalid current attestation");
+    }
+    const intent = resolveCleanupIntent(input, binding, current, mode);
+    for (const attempt of readCleanupAttempts(input.coordRoot, input.runId)) {
+        if (attempt.operation_id !== intent.operation_id ||
+            attempt.binding_id !== binding.binding_id ||
+            attempt.binding_sha256 !== intent.binding_sha256 ||
+            attempt.mode !== intent.mode ||
+            (attempt.attestation !== undefined && !isWorkspaceAttestation(attempt.attestation, binding))) {
+            throw new Error("workspace cleanup attempt does not match the immutable intent");
+        }
+    }
+    const receipt = readWorkflowSupplement(input.coordRoot, input.runId, "cleanup/receipt.json");
+    if (receipt) {
+        validateCleanupReceipt(receipt, binding, intent);
+        if (!isReleasedAttestation(current)) {
+            throw new Error("existing cleanup receipt no longer reattests exact resource absence");
+        }
+        return receipt;
+    }
+    appendCleanupAttempt(input.coordRoot, input.runId, {
+        schema_version: 1,
+        operation_id: intent.operation_id,
+        binding_id: binding.binding_id,
+        binding_sha256: intent.binding_sha256,
+        mode,
+        status: "started",
+        recorded_at: new Date().toISOString(),
+    });
+    const result = await input.provider.cleanup(binding, intent);
+    validateCleanupResult(result, binding);
+    const attempt = appendCleanupAttempt(input.coordRoot, input.runId, {
+        schema_version: 1,
+        operation_id: intent.operation_id,
+        binding_id: binding.binding_id,
+        binding_sha256: intent.binding_sha256,
+        mode,
+        status: result.status,
+        branch_deleted: result.branch_deleted,
+        attestation: result.attestation,
+        reason: result.reason,
+        recorded_at: result.recorded_at,
+    });
+    appendWorkflowJournalEvent(input.coordRoot, input.runId, "workspace.cleanup", {
+        binding_id: binding.binding_id,
+        provider_id: binding.provider.id,
+        operation_id: intent.operation_id,
+        attempt: attempt.seq,
+        status: attempt.status,
+    });
+    if (result.status !== "released" && result.status !== "already_released") {
+        return attempt;
+    }
+    if (!result.branch_deleted || !isReleasedAttestation(result.attestation)) {
+        throw new Error("workspace cleanup cannot receipt an incomplete resource release");
+    }
+    const terminal = {
+        schema_version: 1,
+        receipt_id: `cleanup-${stableDigest({
+            operation: intent.operation_id,
+            binding: intent.binding_sha256,
+        }).slice(0, 24)}`,
+        operation_id: intent.operation_id,
+        binding_id: binding.binding_id,
+        binding_sha256: intent.binding_sha256,
+        mode,
+        status: result.status,
+        branch_deleted: true,
+        attestation: result.attestation,
+        recorded_at: result.recorded_at,
+    };
+    writeWorkflowSupplement(input.coordRoot, input.runId, "cleanup/receipt.json", terminal);
+    return terminal;
+}
+function assertCleanupPathAuthority(binding, allowedPaths) {
+    if (allowedPaths.length > 0 &&
+        (!allowedPaths.some((root) => containsPath(root, binding.workspace_root)) ||
+            !allowedPaths.some((root) => containsPath(root, binding.active_root)) ||
+            (binding.repository !== undefined &&
+                (!allowedPaths.some((root) => containsPath(root, binding.repository.source_root.realpath)) ||
+                    !allowedPaths.some((root) => containsPath(root, binding.repository.common_dir.realpath)))))) {
+        throw new Error("workspace cleanup path is outside frozen policy path authority");
+    }
+    if (!containsPath(binding.writable_root.realpath, binding.workspace_root) ||
+        !containsPath(binding.writable_root.realpath, binding.active_root)) {
+        throw new Error("workspace cleanup path is outside frozen writable-root authority");
+    }
+}
+function acquireCleanupLease(coordRoot, runId) {
+    const authoritySha256 = stableDigest({ run_id: runId, operation: "cleanup" });
+    const lease = acquireNoClobberLease({
+        path: join(workflowRunDir(coordRoot, runId), "cleanup", "operation.lease"),
+        scope: "cleanup",
+        authoritySha256,
+        staleAfterMs: CLEANUP_LEASE_STALE_MS,
+        metadata: { run_id: runId },
+        validateStaleOwner: (owner) => owner.authority_sha256 === authoritySha256 && owner.metadata?.run_id === runId,
+    });
+    return () => lease.release();
+}
+function resolveCleanupIntent(input, binding, attestation, mode) {
+    if (!binding.repository)
+        throw new Error("workspace cleanup requires repository identity");
+    const bindingSha256 = stableDigest(binding);
+    const operationId = `cleanup-${stableDigest({ binding: bindingSha256, mode }).slice(0, 24)}`;
+    const prior = readWorkflowSupplement(input.coordRoot, input.runId, "cleanup/intent.json");
+    if (prior) {
+        if (prior.schema_version !== 1 ||
+            prior.run_id !== input.runId ||
+            prior.binding_id !== binding.binding_id ||
+            prior.binding_sha256 !== bindingSha256 ||
+            prior.mode !== mode ||
+            prior.operation_id !== operationId) {
+            throw new Error("existing cleanup intent does not match current workspace authority");
+        }
+        validateCleanupIntentExpected(prior, binding);
+        return prior;
+    }
+    const workspaceRefOid = attestation.repository?.workspace_ref_oid;
+    const targetRefOid = attestation.repository?.target_ref_oid;
+    if (!workspaceRefOid || !targetRefOid) {
+        throw new Error("workspace cleanup cannot freeze exact source and target ref identities");
+    }
+    const proposed = {
+        schema_version: 1,
+        run_id: input.runId,
+        operation_id: operationId,
+        binding_id: binding.binding_id,
+        binding_sha256: bindingSha256,
+        mode,
+        expected: {
+            worktree_path: binding.workspace_root,
+            gitdir: binding.repository.gitdir,
+            workspace_ref: binding.repository.workspace_ref,
+            workspace_ref_oid: workspaceRefOid,
+            target_ref: binding.repository.target_ref,
+            target_ref_oid: targetRefOid,
+        },
+        created_at: new Date().toISOString(),
+    };
+    writeWorkflowSupplement(input.coordRoot, input.runId, "cleanup/intent.json", proposed);
+    return proposed;
+}
+function validateCleanupIntentExpected(intent, binding) {
+    const repository = binding.repository;
+    if (!repository ||
+        intent.expected.worktree_path !== binding.workspace_root ||
+        stableDigest(intent.expected.gitdir) !== stableDigest(repository.gitdir) ||
+        intent.expected.workspace_ref !== repository.workspace_ref ||
+        intent.expected.target_ref !== repository.target_ref ||
+        !/^[0-9a-f]{40,64}$/.test(intent.expected.workspace_ref_oid) ||
+        !/^[0-9a-f]{40,64}$/.test(intent.expected.target_ref_oid)) {
+        throw new Error("cleanup intent expected identities do not match the workspace binding");
+    }
+}
+function validateCleanupResult(result, binding) {
+    if (result.schema_version !== 1 ||
+        result.binding_id !== binding.binding_id ||
+        ![
+            "released",
+            "already_released",
+            "preserved_dirty",
+            "blocked",
+            "unsupported",
+            "partial",
+        ].includes(result.status) ||
+        !Number.isFinite(Date.parse(result.recorded_at)) ||
+        typeof result.branch_deleted !== "boolean" ||
+        !isWorkspaceAttestation(result.attestation, binding) ||
+        ((result.status === "released" || result.status === "already_released") &&
+            !isReleasedAttestation(result.attestation))) {
+        throw new Error("workspace cleanup provider returned an invalid result");
+    }
+}
+function validateCleanupReceipt(receipt, binding, intent) {
+    if (receipt.schema_version !== 1 ||
+        receipt.operation_id !== intent.operation_id ||
+        receipt.binding_id !== binding.binding_id ||
+        receipt.binding_sha256 !== intent.binding_sha256 ||
+        receipt.mode !== intent.mode ||
+        (receipt.status !== "released" && receipt.status !== "already_released") ||
+        receipt.branch_deleted !== true ||
+        !isWorkspaceAttestation(receipt.attestation, binding) ||
+        !isReleasedAttestation(receipt.attestation)) {
+        throw new Error("workspace cleanup receipt is invalid or mismatched");
+    }
+}
+function isReleasedAttestation(attestation) {
+    return (attestation.status === "ok" &&
+        attestation.provider_drift.length === 0 &&
+        attestation.resource_state === "released" &&
+        !attestation.workspace_exists);
+}

package/dist/core/workflow/workspaces/execution.d.ts

@@ -0,0 +1,25 @@
+import { type NormalizedPolicy } from "../../policy/index.js";
+import type { WorkflowRunManifest } from "../run-state.js";
+import type { EngineOpts, WorkflowAttemptContext, WorkflowWorkContext } from "../types.js";
+import type { WorkspaceAttestation, WorkspaceBinding, WorkspaceProvider, WorkspaceUnsupportedExecutionEvidence } from "./types.js";
+interface WorkspaceResumeState {
+    manifest: WorkflowRunManifest;
+}
+export declare function resolveWorkspaceBinding(input: {
+    opts: EngineOpts;
+    resumeState: WorkspaceResumeState | undefined;
+    runId: string;
+    cwd: string;
+    isolation: string;
+    absScript: string;
+    scriptSha256: string;
+    provider: WorkspaceProvider | undefined;
+    workContext: Readonly<WorkflowWorkContext> | undefined;
+    attemptContext: Readonly<WorkflowAttemptContext> | undefined;
+    policy: NormalizedPolicy | undefined;
+    onUnsupportedFallback?: (evidence: WorkspaceUnsupportedExecutionEvidence) => void;
+}): Promise<WorkspaceBinding | undefined>;
+export declare function attestTerminal(provider: WorkspaceProvider | undefined, binding: WorkspaceBinding): Promise<WorkspaceAttestation>;
+export declare function attestWorkspaceFailure(provider: WorkspaceProvider | undefined, binding: WorkspaceBinding, error: unknown): Promise<WorkspaceAttestation>;
+export {};
+//# sourceMappingURL=execution.d.ts.map

package/dist/core/workflow/workspaces/execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/execution.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,gBAAgB,EAAgB,MAAM,uBAAuB,CAAC;AAC5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAU3F,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAEhB,iBAAiB,EACjB,qCAAqC,EACtC,MAAM,YAAY,CAAC;AAGpB,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,IAAI,EAAE,UAAU,CAAC;IACjB,WAAW,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACxC,WAAW,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC;IACvD,cAAc,EAAE,QAAQ,CAAC,sBAAsB,CAAC,GAAG,SAAS,CAAC;IAC7D,MAAM,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACrC,qBAAqB,CAAC,EAAE,CAAC,QAAQ,EAAE,qCAAqC,KAAK,IAAI,CAAC;CACnF,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAuOxC;AAgDD,wBAAsB,cAAc,CAClC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,EACvC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,oBAAoB,CAAC,CAa/B;AAED,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,iBAAiB,GAAG,SAAS,EACvC,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,oBAAoB,CAAC,CAW/B"}

package/dist/core/workflow/workspaces/execution.js

@@ -0,0 +1,316 @@
+import { existsSync } from "node:fs";
+import { policyDigest } from "../../policy/index.js";
+import { WorkspaceAttestationError, workspaceAttestationFromError } from "./attestation-error.js";
+import { assertContainedExisting, containsPath, filesystemIdentity, sameFilesystemIdentity, validateConfiguredRoot, } from "./paths.js";
+import { appendWorkflowJournalEvent, stableDigest, writeWorkspaceRequest } from "./state.js";
+import { isWorkspaceAttestation, isWorkspaceBinding } from "./validate.js";
+export async function resolveWorkspaceBinding(input) {
+    if (input.isolation === "shared")
+        return undefined;
+    if (input.isolation !== "worktree" &&
+        input.isolation !== "sandbox" &&
+        input.isolation !== "remote") {
+        throw new Error(`unsupported workflow isolation ${JSON.stringify(input.isolation)}`);
+    }
+    if (input.resumeState && !input.resumeState.manifest.execution.workspace_binding) {
+        return undefined;
+    }
+    const capability = input.isolation;
+    const provider = input.provider;
+    if (!provider) {
+        if (input.resumeState?.manifest.execution.workspace_binding) {
+            throw new Error("isolated workflow resume requires the frozen workspace provider");
+        }
+        const fallback = {
+            schema_version: 1,
+            run_id: input.runId,
+            requested_isolation: capability,
+            effective_isolation: "shared",
+            selection_reason: "provider_not_configured",
+            terminal_lifecycle_state: "shared",
+            drift: [],
+            unsupported: [
+                {
+                    code: "provider_not_configured",
+                    message: "no workspace provider is configured; shared execution was selected",
+                },
+            ],
+            unknowns: [],
+            receipts: {},
+        };
+        appendWorkflowJournalEvent(input.opts.coordRoot, input.runId, "workspace.compatibility", {
+            requested_isolation: fallback.requested_isolation,
+            effective_isolation: fallback.effective_isolation,
+            selection_reason: fallback.selection_reason,
+            unsupported: fallback.unsupported,
+        });
+        input.onUnsupportedFallback?.(fallback);
+        return undefined;
+    }
+    const frozenBinding = input.resumeState?.manifest.execution.workspace_binding;
+    if (frozenBinding) {
+        const roots = input.opts.workspace?.writableRoots;
+        if (!roots || roots.length === 0) {
+            throw new Error("isolated workflow resume requires explicit writable roots");
+        }
+        assertWorkspaceRootAuthority(frozenBinding, roots, input.policy?.allowed_paths ?? []);
+        const probe = await provider.probe({
+            requested_cwd: frozenBinding.repository?.source_root.configured ?? input.cwd,
+            writable_roots: roots,
+        });
+        if (probe.capabilities.provider_id !== frozenBinding.provider.id ||
+            probe.capabilities.provider_version !== frozenBinding.provider.version ||
+            probe.capabilities.capability_digest !== frozenBinding.provider.capability_digest) {
+            throw new Error("parked workflow provider identity or capabilities drifted");
+        }
+        const providerBinding = await provider.readBinding(frozenBinding);
+        if (JSON.stringify(providerBinding) !== JSON.stringify(frozenBinding)) {
+            throw new Error("parked workflow binding differs from the immutable provider record");
+        }
+        const reattached = await provider.reattach(frozenBinding);
+        if (!isWorkspaceAttestation(reattached, frozenBinding) || reattached.status !== "ok") {
+            if (isWorkspaceAttestation(reattached, frozenBinding)) {
+                throw new WorkspaceAttestationError(`workflow run ${input.runId} could not reattach its frozen workspace`, reattached);
+            }
+            throw new Error(`workflow run ${input.runId} could not reattach its frozen workspace`);
+        }
+        appendWorkflowJournalEvent(input.opts.coordRoot, input.runId, "workspace.reattach", {
+            binding_id: frozenBinding.binding_id,
+            provider_id: frozenBinding.provider.id,
+            attestation_sha256: stableDigest(reattached),
+        });
+        return frozenBinding;
+    }
+    const roots = input.opts.workspace?.writableRoots;
+    if (roots?.length !== 1) {
+        throw new Error("isolated workflow allocation requires one explicitly selected writable root");
+    }
+    const selectedRoot = validateConfiguredRoot(roots[0]);
+    const sourceRoot = validateConfiguredRoot(input.cwd);
+    const allowedRoots = (input.policy?.allowed_paths ?? []).map((path) => validateConfiguredRoot(path));
+    if (sourceRoot.configured !== input.cwd ||
+        (allowedRoots.length > 0 &&
+            !allowedRoots.some((path) => containsPath(path.realpath, sourceRoot.realpath)))) {
+        throw new Error("workflow source root is outside frozen path authority");
+    }
+    if (allowedRoots.length > 0 &&
+        !allowedRoots.some((path) => containsPath(path.realpath, selectedRoot.realpath))) {
+        throw new Error("workspace writable root is outside frozen path authority");
+    }
+    const probe = await provider.probe({
+        requested_cwd: input.cwd,
+        writable_roots: [selectedRoot.configured],
+    });
+    if (!probe.supported ||
+        probe.unsupported.length > 0 ||
+        !probe.capabilities.isolation.includes(capability)) {
+        if (input.policy?.allowed_isolation?.includes("shared")) {
+            const unsupported = probe.unsupported.length > 0
+                ? [...probe.unsupported]
+                : [
+                    {
+                        code: "isolation_unsupported",
+                        message: `provider does not support ${capability} isolation`,
+                    },
+                ];
+            const fallback = {
+                schema_version: 1,
+                run_id: input.runId,
+                requested_isolation: capability,
+                effective_isolation: "shared",
+                selection_reason: "provider_unsupported",
+                provider: {
+                    id: probe.capabilities.provider_id,
+                    version: probe.capabilities.provider_version,
+                    capability_digest: probe.capabilities.capability_digest,
+                },
+                terminal_lifecycle_state: "shared",
+                drift: [],
+                unsupported,
+                unknowns: [...probe.unknowns],
+                receipts: {},
+            };
+            appendWorkflowJournalEvent(input.opts.coordRoot, input.runId, "workspace.fallback", {
+                requested_isolation: fallback.requested_isolation,
+                effective_isolation: fallback.effective_isolation,
+                selection_reason: fallback.selection_reason,
+                provider_id: fallback.provider?.id,
+                unsupported: fallback.unsupported,
+            });
+            input.onUnsupportedFallback?.(fallback);
+            return undefined;
+        }
+        throw new Error(`workspace provider ${probe.capabilities.provider_id} does not support ${capability}: ${probe.unsupported.map((item) => item.message).join("; ") || "unsupported capability"}`);
+    }
+    if (input.opts.workItemId && !input.attemptContext) {
+        throw new Error("isolated work-linked execution requires a frozen attempt identity");
+    }
+    const requestWithoutKey = {
+        schema_version: 1,
+        run_id: input.runId,
+        owner: input.opts.workItemId && input.attemptContext
+            ? {
+                kind: "work_attempt",
+                work_item_id: input.opts.workItemId,
+                attempt: input.attemptContext.number,
+            }
+            : { kind: "standalone", work_item_id: null, attempt: null },
+        requested_cwd: input.cwd,
+        requested_isolation: capability,
+        network_access: input.opts.networkAccess ?? "unknown",
+        script: { path: input.absScript, sha256: input.scriptSha256 },
+        policy_sha256: input.policy ? policyDigest(input.policy) : null,
+        allowed_paths: allowedRoots,
+        writable_roots: [selectedRoot],
+        selected_writable_root: selectedRoot,
+        provider_id: probe.capabilities.provider_id,
+        capability_digest: probe.capabilities.capability_digest,
+    };
+    const request = {
+        ...requestWithoutKey,
+        idempotency_key: stableDigest(requestWithoutKey),
+    };
+    writeWorkspaceRequest(input.opts.coordRoot, request);
+    appendWorkflowJournalEvent(input.opts.coordRoot, input.runId, "execution.allocate.start", {
+        provider_id: probe.capabilities.provider_id,
+        request_sha256: stableDigest(request),
+    });
+    const binding = await provider.allocate(request);
+    if (!isWorkspaceBinding(binding, input.runId) ||
+        binding.request_sha256 !== stableDigest(request) ||
+        stableDigest(binding.owner) !== stableDigest(request.owner) ||
+        binding.provider.id !== probe.capabilities.provider_id ||
+        binding.provider.version !== probe.capabilities.provider_version ||
+        binding.provider.capability_digest !== probe.capabilities.capability_digest ||
+        binding.isolation !== capability) {
+        throw new Error("workspace provider returned a binding that does not match the frozen request");
+    }
+    const providerBinding = await provider.readBinding(binding);
+    if (JSON.stringify(providerBinding) !== JSON.stringify(binding)) {
+        throw new Error("workspace provider returned bytes that differ from its immutable binding");
+    }
+    assertWorkspaceRootAuthority(binding, [selectedRoot.configured], input.policy?.allowed_paths ?? []);
+    const attestation = await provider.reattach(binding);
+    if (!isWorkspaceAttestation(attestation, binding) || attestation.status !== "ok") {
+        if (isWorkspaceAttestation(attestation, binding)) {
+            throw new WorkspaceAttestationError("workspace provider returned a binding that failed initial attestation", attestation);
+        }
+        throw new Error("workspace provider returned a binding that failed initial attestation");
+    }
+    appendWorkflowJournalEvent(input.opts.coordRoot, input.runId, "execution.allocate.end", {
+        binding_id: binding.binding_id,
+        provider_id: binding.provider.id,
+        active_root: binding.active_root,
+        attestation_sha256: stableDigest(attestation),
+    });
+    return binding;
+}
+function assertWorkspaceRootAuthority(binding, configuredRoots, allowedPaths) {
+    const roots = configuredRoots.map((root) => validateConfiguredRoot(root));
+    const authority = roots.find((root) => root.configured === binding.writable_root.configured &&
+        root.realpath === binding.writable_root.realpath &&
+        sameFilesystemIdentity(root.identity, binding.writable_root.identity));
+    if (!authority) {
+        throw new Error("workspace provider binding is outside the explicit writable-root authority");
+    }
+    if (allowedPaths.length > 0 &&
+        (!allowedPaths.some((root) => containsPath(root, binding.workspace_root)) ||
+            !allowedPaths.some((root) => containsPath(root, binding.active_root)) ||
+            (binding.repository !== undefined &&
+                (!allowedPaths.some((root) => containsPath(root, binding.repository.source_root.realpath)) ||
+                    !allowedPaths.some((root) => containsPath(root, binding.repository.common_dir.realpath)))))) {
+        throw new Error("workspace provider binding is outside frozen policy path authority");
+    }
+    assertContainedExisting(authority, binding.workspace_root, "workspace root");
+    assertContainedExisting(authority, binding.active_root, "active workspace root");
+    if (!sameFilesystemIdentity(filesystemIdentity(binding.workspace_root), binding.workspace_root_identity)) {
+        throw new Error("workspace root identity differs from the frozen binding");
+    }
+    if (!sameFilesystemIdentity(filesystemIdentity(binding.active_root), binding.active_root_identity)) {
+        throw new Error("active workspace root identity differs from the frozen binding");
+    }
+}
+export async function attestTerminal(provider, binding) {
+    if (!provider)
+        return failedWorkspaceAttestation(binding, "workspace provider is unavailable");
+    try {
+        const attestation = await provider.attest(binding);
+        return isWorkspaceAttestation(attestation, binding)
+            ? attestation
+            : failedWorkspaceAttestation(binding, "workspace provider returned invalid attestation");
+    }
+    catch (error) {
+        return (workspaceAttestationFromError(error, binding) ??
+            failedWorkspaceAttestation(binding, errorMessage(error)));
+    }
+}
+export async function attestWorkspaceFailure(provider, binding, error) {
+    const carried = workspaceAttestationFromError(error, binding);
+    if (carried)
+        return carried;
+    const observed = await attestTerminal(provider, binding);
+    if (observed.status !== "ok")
+        return observed;
+    return {
+        ...observed,
+        provider_drift: [...observed.provider_drift, errorMessage(error)],
+        resource_state: observed.workspace_exists ? "blocked" : "lost",
+        status: observed.workspace_exists ? "blocked" : "lost",
+    };
+}
+function failedWorkspaceAttestation(binding, message) {
+    const workspaceExists = existsSync(binding.workspace_root);
+    let rootMatch = false;
+    let workspaceContained = false;
+    let activeContained = false;
+    let workspaceIdentity;
+    let activeIdentity;
+    try {
+        const root = validateConfiguredRoot(binding.writable_root.configured);
+        rootMatch =
+            root.realpath === binding.writable_root.realpath &&
+                sameFilesystemIdentity(root.identity, binding.writable_root.identity);
+        if (workspaceExists) {
+            const workspaceReal = assertContainedExisting(root, binding.workspace_root, "workspace root");
+            workspaceContained = workspaceReal === binding.workspace_root;
+            workspaceIdentity = filesystemIdentity(workspaceReal);
+        }
+        if (existsSync(binding.active_root)) {
+            const activeReal = assertContainedExisting(root, binding.active_root, "active root");
+            activeContained = activeReal === binding.active_root;
+            activeIdentity = filesystemIdentity(activeReal);
+        }
+    }
+    catch {
+        // Preserve the facts that could be observed before path validation failed.
+    }
+    return {
+        schema_version: 1,
+        binding_id: binding.binding_id,
+        workspace_id: binding.workspace_id,
+        run_id: binding.run_id,
+        owner: binding.owner,
+        provider: binding.provider,
+        recorded_at: new Date().toISOString(),
+        containment: {
+            writable_root: rootMatch,
+            workspace_root: workspaceContained,
+            active_root: activeContained,
+            integration_root: null,
+        },
+        filesystem: {
+            root_identity_match: rootMatch,
+            workspace_identity: workspaceIdentity,
+            active_identity: activeIdentity,
+        },
+        provider_drift: [message],
+        workspace_exists: workspaceExists,
+        resource_state: workspaceExists ? "blocked" : "lost",
+        unsupported: [],
+        unknowns: [],
+        status: workspaceExists ? "blocked" : "lost",
+    };
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/core/workflow/workspaces/git.d.ts

@@ -0,0 +1,25 @@
+export type GitResult = {
+    ok: true;
+    out: string;
+} | {
+    ok: false;
+    err: string;
+};
+export declare function git(cwd: string, args: readonly string[]): string;
+export declare function gitMaybe(cwd: string, args: readonly string[]): GitResult;
+export declare function gitMaybeWithDirectoryDescriptor(cwd: string, args: readonly string[], fd: number): GitResult;
+export declare function worktreeInventory(cwd: string): Array<{
+    path: string;
+    ref?: string;
+    head?: string;
+}>;
+export declare function parseWorktreeInventory(body: string): Array<{
+    path: string;
+    ref?: string;
+    head?: string;
+}>;
+export declare function gitOperations(cwd: string): string[];
+export declare function overwriteRiskPaths(cwd: string, changed: readonly string[]): string[];
+export declare function isAncestor(cwd: string, ancestor: string, descendant: string): boolean;
+export declare function nulEntries(value: string): string[];
+//# sourceMappingURL=git.d.ts.map

package/dist/core/workflow/workspaces/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/git.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIhE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAExE;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,MAAM,GACT,SAAS,CAKX;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,GACV,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAEtD;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,GACX,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBtD;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAenD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAOpF;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAErF;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAElD"}