harnery 0.26.0 → 0.28.0

package/dist/core/workflow/engine.js

@@ -25,7 +25,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { createHash, randomBytes } from "node:crypto";
-import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
 import { isAbsolute, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { snapshotRepo } from "../context/index.js";
@@ -34,15 +34,27 @@ import { assertWorkflowRunId, createWorkflowApproval } from "./approvals.js";
 import { freezeWorkflowAttemptContext } from "./attempt-context.js";
 import { probeBilling } from "./billing.js";
 import { stableDigest } from "./durable-record.js";
+import { appendWorkflowJournalEvent } from "./journal.js";
 import { buildWorkflowProof, createEvidenceRecord, digestResult, normalizeWorkflowMeta, writeWorkflowProof, } from "./proof.js";
 import { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
+import { assertProjectionWithinWorkspace, resolveGitGrantRoots } from "./sandbox-projection.js";
 import { normalizeWorkflowSpecialists, resolveSpecialistAssignment } from "./specialists.js";
-import { WORKFLOW_PROOF_SCHEMA_VERSION } from "./types.js";
 import { parseStageOutput, validateAgainstSchema } from "./validate.js";
 import { freezeWorkflowWorkContext } from "./work-context.js";
 import { attestTerminal, attestWorkspaceFailure, resolveWorkspaceBinding, } from "./workspaces/execution.js";
-import { appendWorkflowJournalEvent } from "./workspaces/state.js";
 import { isWorkspaceAttestation } from "./workspaces/validate.js";
+/** Proof record of the filesystem projection a run applied (ADR 0039/0040).
+ * Absent when no policy was in force, which reads as "no projection applied"
+ * rather than "an empty one". */
+function sandboxProjectionEvidence(policy, gitWrite) {
+    if (!policy)
+        return undefined;
+    return {
+        mode: policy.mode,
+        writable_roots: [...(policy.writableRoots ?? [])],
+        git_grant: gitWrite,
+    };
+}
 const DEFAULT_MAX_AGENTS = 50;
 const DEFAULT_CONCURRENCY = 4;
 const DEFAULT_MAX_ATTEMPTS = 2;
@@ -246,6 +258,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 evidence: [],
                 harnessEvidence: opts.harnessEvidence,
                 harnessAttestations: opts.harnessAttestations,
+                sandboxProjection: sandboxProjectionEvidence(opts.filesystemPolicy, opts.gitWrite ?? "none"),
                 policy: policy
                     ? {
                         config: policy,
@@ -267,6 +280,30 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
     }
     const effectiveIsolation = workspaceFallback?.effective_isolation ?? isolation;
     const executionCwd = workspaceBinding?.active_root ?? cwd;
+    // Validate the projection once, before any child launches, so a policy that
+    // would reach outside the provider's validated root fails the run rather than
+    // silently widening one child's write access (ADR 0039).
+    const requestedPolicy = opts.filesystemPolicy;
+    if (requestedPolicy?.writableRoots?.length) {
+        if (!workspaceBinding) {
+            throw new Error("a filesystem policy with writable roots requires an isolated workspace; none is bound to this run");
+        }
+        assertProjectionWithinWorkspace("workflow", workspaceBinding.writable_root.realpath, requestedPolicy.writableRoots);
+    }
+    // The Git grant is resolved after containment on purpose: caller-supplied
+    // roots must stay inside the workspace, while these come from the verified
+    // binding and are the one sanctioned way out of it (ADR 0040).
+    const gitWrite = opts.gitWrite ?? "none";
+    const gitGrantRoots = resolveGitGrantRoots(gitWrite, workspaceBinding);
+    if (gitGrantRoots.length > 0 && !requestedPolicy) {
+        throw new Error(`gitWrite "${gitWrite}" has no effect without a filesystem policy to carry it; set filesystemPolicy or drop the grant`);
+    }
+    const filesystemPolicy = requestedPolicy
+        ? {
+            ...requestedPolicy,
+            writableRoots: [...(requestedPolicy.writableRoots ?? []), ...gitGrantRoots],
+        }
+        : undefined;
     const executionRepoBefore = resumeState?.manifest.repository_before ?? snapshotRepo(executionCwd);
     if (!resumeState) {
         writeWorkflowRunManifest({
@@ -379,15 +416,18 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
     const policyDecisions = new Map(history?.policyDecisions.map((decision) => [decision.id, decision]));
     const acceptanceIds = new Set(meta.acceptance.map((criterion) => criterion.id));
     const journal = (event, data) => {
-        const line = JSON.stringify({
-            schema_version: WORKFLOW_PROOF_SCHEMA_VERSION,
-            run_id: runId,
-            ts: new Date().toISOString(),
-            event,
-            stage: currentStage,
+        appendWorkflowJournalEvent(opts.coordRoot, runId, event, { stage: currentStage, ...data });
+    };
+    const journalAgentEnd = (data, resultKind, result) => {
+        // The writer shrinks an oversized record itself and names what it dropped,
+        // so no per-call fallback is needed here. A digest rides along regardless so
+        // a shrunk record can still be tied back to the exact result.
+        journal("agent.end", {
             ...data,
+            result_kind: resultKind,
+            result_digest: digestResult(result, resultKind),
+            result,
         });
-        appendFileSync(journalPath, `${line}\n`, "utf8");
     };
     // Bounded concurrency gate shared by every spawn in the run — direct
     // `agent()` calls and `parallel()` thunks draw from the same slot pool, so
@@ -726,6 +766,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                     cwd: executionCwd,
                     runId,
                     subscriptionOnly,
+                    filesystemPolicy,
                 });
                 agentProof.attempts = attempt;
                 agentProof.duration_ms += last.durationMs;
@@ -741,7 +782,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                         agentCostUsd > 0 || last.costUsd !== undefined ? agentCostUsd : undefined;
                     agentProof.session_id = last.sessionId;
                     agentProof.result = digestResult(last.text, "text");
-                    journal("agent.end", {
+                    journalAgentEnd({
                         id,
                         key,
                         attempts: attempt,
@@ -749,9 +790,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                         total_cost_usd: agentCostUsd,
                         duration_ms: last.durationMs,
                         session_id: last.sessionId,
-                        result_kind: "text",
-                        result: last.text,
-                    });
+                    }, "text", last.text);
                     return last.text;
                 }
                 const parsed = parseStageOutput(last.text);
@@ -764,7 +803,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                         agentCostUsd > 0 || last.costUsd !== undefined ? agentCostUsd : undefined;
                     agentProof.session_id = last.sessionId;
                     agentProof.result = digestResult(parsed.value, "json");
-                    journal("agent.end", {
+                    journalAgentEnd({
                         id,
                         key,
                         attempts: attempt,
@@ -772,9 +811,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                         total_cost_usd: agentCostUsd,
                         duration_ms: last.durationMs,
                         session_id: last.sessionId,
-                        result_kind: "json",
-                        result: parsed.value,
-                    });
+                    }, "json", parsed.value);
                     return parsed.value;
                 }
                 journal("agent.schema_retry", { id, attempt, problems });
@@ -927,6 +964,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 evidence: evidenceRecords,
                 harnessEvidence: opts.harnessEvidence,
                 harnessAttestations: opts.harnessAttestations,
+                sandboxProjection: sandboxProjectionEvidence(filesystemPolicy, gitWrite),
                 policy: policy
                     ? {
                         config: policy,
@@ -1005,6 +1043,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 evidence: evidenceRecords,
                 harnessEvidence: opts.harnessEvidence,
                 harnessAttestations: opts.harnessAttestations,
+                sandboxProjection: sandboxProjectionEvidence(filesystemPolicy, gitWrite),
                 policy: policy
                     ? {
                         config: policy,
@@ -1086,7 +1125,10 @@ function loadResumeCache(coordRoot, resumeFrom) {
             continue;
         try {
             const e = JSON.parse(line);
-            if (e.event === "agent.end" && e.key && e.result_kind !== undefined) {
+            if (e.event === "agent.end" &&
+                e.key &&
+                (e.result_kind === "json" || e.result_kind === "text") &&
+                "result" in e) {
                 cache.set(e.key, { kind: e.result_kind, value: e.result });
             }
         }

package/dist/core/workflow/index.d.ts

@@ -8,5 +8,5 @@ export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowS
 export type { AcceptanceCriterion, AcceptanceResult, AcceptanceStatus, AcceptanceSummary, AgentOpts, EngineOpts, EvidenceKind, EvidenceSource, EvidenceStatus, HarnessEvidenceCapability, HarnessEvidenceCoverage, HarnessName, ResultDigest, RunReport, Spawner, SpawnRequest, SpawnResult, StageSchema, WorkflowAgentProof, WorkflowApprovalMode, WorkflowAttemptContext, WorkflowAttemptFailureCause, WorkflowAttemptPriorContext, WorkflowAttemptUnresolvedCriterion, WorkflowContext, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowModule, WorkflowPolicyProof, WorkflowProof, WorkflowProofUnknown, WorkflowRepoEvidence, WorkflowRepoSnapshot, WorkflowRunStatus, WorkflowSpecialistProfile, WorkflowWorkContext, } from "./types.js";
 export { WORKFLOW_ATTEMPT_CONTEXT_SCHEMA_VERSION, WORKFLOW_PROOF_SCHEMA_VERSION, WORKFLOW_WORK_CONTEXT_SCHEMA_VERSION, } from "./types.js";
 export type { ApplyIntegrationInput, AuthorizedIntegrationPlan, AuthorizedProviderIntegrationInput, CancelWorkspaceInput, CleanupWorkspaceInput, FilesystemIdentity, IntegrationApplyAttempt, IntegrationApplyReceipt, IntegrationAuthorization, IntegrationPlan, IntegrationReviewRecord, IntegrationTarget, LocalGitWorktreeProviderOptions, PrepareIntegrationInput, ProviderIntegrationInput, ProviderIntegrationPreview, ProviderIntegrationResult, ProviderUnknown, ProviderUnsupportedReason, RepositoryBinding, ValidatedFilesystemPath, WorkflowWorkspaceInspection, WorkflowWorkspaceSelection, WorkflowWorkspaceStatus, WorkflowWorkspaceVerification, WorkspaceAllocationRequest, WorkspaceAttestation, WorkspaceBinding, WorkspaceBoundExecutionEvidence, WorkspaceCancellationReceipt, WorkspaceCancellationResult, WorkspaceCleanupAttempt, WorkspaceCleanupIntent, WorkspaceCleanupMode, WorkspaceCleanupReceipt, WorkspaceCleanupResult, WorkspaceCompatibilityExecutionEvidence, WorkspaceExecutionEvidence, WorkspaceIntegrationState, WorkspaceIsolation, WorkspaceLifecycleProjection, WorkspaceLifecycleProjectionInput, WorkspaceLifecycleState, WorkspaceObservation, WorkspaceOwner, WorkspaceProbeInput, WorkspaceProbeResult, WorkspaceProofOutcome, WorkspaceProvider, WorkspaceProviderCapabilities, WorkspaceProviderRef, WorkspaceResourceState, WorkspaceUnsupportedExecutionEvidence, } from "./workspaces/index.js";
-export { applyIntegration, assertWorkspaceLifecycleTransition, cancelWorkspace, cleanupWorkspace, createLocalGitWorktreeProvider, deriveWorkspaceLifecycle, IntegrationPrepareParkedError, inspectWorkflowWorkspace, isWorkspaceLifecycleState, listWorkflowWorkspaceInspections, prepareIntegration, probeLocalGitWorktreeProvider, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, validateProviderEventChain, WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./workspaces/index.js";
+export { applyIntegration, assertWorkspaceLifecycleTransition, cancelWorkspace, cleanupWorkspace, createLocalGitWorktreeProvider, deriveWorkspaceLifecycle, IntegrationPrepareParkedError, inspectWorkflowWorkspace, isWorkspaceLifecycleState, listWorkflowWorkspaceInspections, prepareIntegration, prepareReclaim, probeLocalGitWorktreeProvider, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, validateProviderEventChain, WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./workspaces/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/core/workflow/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,gCAAgC,EAChC,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,uBAAuB,EACvB,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,EACX,YAAY,EACZ,SAAS,EACT,OAAO,EACP,YAAY,EACZ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,kCAAkC,EAClC,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uCAAuC,EACvC,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,EAChB,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,iCAAiC,EACjC,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,qCAAqC,GACtC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,EAChB,kCAAkC,EAClC,eAAe,EACf,gBAAgB,EAChB,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,EAC7B,wBAAwB,EACxB,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,gCAAgC,EAChC,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,uBAAuB,EACvB,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,EACX,YAAY,EACZ,SAAS,EACT,OAAO,EACP,YAAY,EACZ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,kCAAkC,EAClC,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uCAAuC,EACvC,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,EAChB,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,iCAAiC,EACjC,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,qCAAqC,GACtC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,EAChB,kCAAkC,EAClC,eAAe,EACf,gBAAgB,EAChB,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,EAC7B,wBAAwB,EACxB,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,cAAc,EACd,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,uBAAuB,CAAC"}

package/dist/core/workflow/index.js

@@ -4,4 +4,4 @@ export { runWorkflow, WorkflowParkedError, WorkflowRunError } from "./engine.js"
 export { buildWorkflowProof, createEvidenceRecord, digestResult, normalizeWorkflowMeta, readWorkflowProof, renderWorkflowProof, rollupAcceptance, writeWorkflowProof, } from "./proof.js";
 export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
 export { WORKFLOW_ATTEMPT_CONTEXT_SCHEMA_VERSION, WORKFLOW_PROOF_SCHEMA_VERSION, WORKFLOW_WORK_CONTEXT_SCHEMA_VERSION, } from "./types.js";
-export { applyIntegration, assertWorkspaceLifecycleTransition, cancelWorkspace, cleanupWorkspace, createLocalGitWorktreeProvider, deriveWorkspaceLifecycle, IntegrationPrepareParkedError, inspectWorkflowWorkspace, isWorkspaceLifecycleState, listWorkflowWorkspaceInspections, prepareIntegration, probeLocalGitWorktreeProvider, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, validateProviderEventChain, WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./workspaces/index.js";
+export { applyIntegration, assertWorkspaceLifecycleTransition, cancelWorkspace, cleanupWorkspace, createLocalGitWorktreeProvider, deriveWorkspaceLifecycle, IntegrationPrepareParkedError, inspectWorkflowWorkspace, isWorkspaceLifecycleState, listWorkflowWorkspaceInspections, prepareIntegration, prepareReclaim, probeLocalGitWorktreeProvider, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, validateProviderEventChain, WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./workspaces/index.js";

package/dist/core/workflow/journal.d.ts

@@ -0,0 +1,30 @@
+export declare const WORKFLOW_JOURNAL_EVENT_BYTES: number;
+/** Key under which a shrunk record names the fields it had to drop. */
+export declare const WORKFLOW_JOURNAL_OMITTED = "omitted_fields";
+export interface WorkflowJournalOmission {
+    field: string;
+    bytes: number;
+    sha256: string;
+}
+export declare function workflowJournalPath(coordRoot: string, runId: string): string;
+/**
+ * Append one journal record, always.
+ *
+ * A record that would exceed what a reader accepts has its largest fields
+ * replaced by a digest and a byte count until it fits, and it names what it
+ * dropped. Size never raises.
+ *
+ * Refusing an oversized record would let a valid run fail on its own opening
+ * line: `run.start` carries the workflow's declared metadata plus the frozen
+ * work and attempt context, and Harnery's own validators permit those to exceed
+ * this limit by construction. Losing detail from a record is recoverable.
+ * Losing the run that was writing it is not.
+ */
+export declare function appendWorkflowJournalEvent(coordRoot: string, runId: string, event: string, data: Record<string, unknown>): void;
+/**
+ * Shrink a record to the reader's limit by dropping its largest fields first.
+ * The envelope is never dropped, so a record keeps its run id, timestamp, and
+ * event name however much detail it loses. Exported for tests.
+ */
+export declare function fitWorkflowJournalRecord(envelope: Record<string, unknown>, data: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=journal.d.ts.map

package/dist/core/workflow/journal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/journal.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,4BAA4B,QAAY,CAAC;AAEtD,uEAAuE;AACvE,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AAIzD,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAG5E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,IAAI,CAiBN;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoBzB"}

package/dist/core/workflow/journal.js

@@ -0,0 +1,70 @@
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fsyncParentDirectory, stableDigest } from "./durable-record.js";
+// Limit for the JSON record body. The trailing newline delimiter is outside the
+// record and is not counted by readers after splitting journal lines.
+export const WORKFLOW_JOURNAL_EVENT_BYTES = 16 * 1024;
+/** Key under which a shrunk record names the fields it had to drop. */
+export const WORKFLOW_JOURNAL_OMITTED = "omitted_fields";
+const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
+export function workflowJournalPath(coordRoot, runId) {
+    if (!RUN_ID.test(runId))
+        throw new Error(`invalid workflow run id ${JSON.stringify(runId)}`);
+    return join(resolve(coordRoot), ".harnery", "workflows", runId, "journal.jsonl");
+}
+/**
+ * Append one journal record, always.
+ *
+ * A record that would exceed what a reader accepts has its largest fields
+ * replaced by a digest and a byte count until it fits, and it names what it
+ * dropped. Size never raises.
+ *
+ * Refusing an oversized record would let a valid run fail on its own opening
+ * line: `run.start` carries the workflow's declared metadata plus the frozen
+ * work and attempt context, and Harnery's own validators permit those to exceed
+ * this limit by construction. Losing detail from a record is recoverable.
+ * Losing the run that was writing it is not.
+ */
+export function appendWorkflowJournalEvent(coordRoot, runId, event, data) {
+    const path = workflowJournalPath(coordRoot, runId);
+    const record = fitWorkflowJournalRecord({ schema_version: 1, run_id: runId, ts: new Date().toISOString(), event }, data);
+    const line = `${JSON.stringify(record)}\n`;
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const existed = existsSync(path);
+    const fd = openSync(path, "a", 0o600);
+    try {
+        writeFileSync(fd, line, "utf8");
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    if (!existed)
+        fsyncParentDirectory(path);
+}
+/**
+ * Shrink a record to the reader's limit by dropping its largest fields first.
+ * The envelope is never dropped, so a record keeps its run id, timestamp, and
+ * event name however much detail it loses. Exported for tests.
+ */
+export function fitWorkflowJournalRecord(envelope, data) {
+    const candidate = { ...envelope, ...data };
+    if (Buffer.byteLength(JSON.stringify(candidate)) <= WORKFLOW_JOURNAL_EVENT_BYTES) {
+        return candidate;
+    }
+    const kept = { ...data };
+    const omitted = [];
+    const bySize = Object.keys(data)
+        .map((field) => ({ field, bytes: Buffer.byteLength(JSON.stringify(data[field]) ?? "") }))
+        .sort((a, b) => b.bytes - a.bytes);
+    for (const { field, bytes } of bySize) {
+        omitted.push({ field, bytes, sha256: stableDigest(data[field]) });
+        delete kept[field];
+        const next = { ...envelope, ...kept, [WORKFLOW_JOURNAL_OMITTED]: omitted };
+        if (Buffer.byteLength(JSON.stringify(next)) <= WORKFLOW_JOURNAL_EVENT_BYTES)
+            return next;
+    }
+    // Every field dropped and still over: the omission list is itself the excess.
+    // Keep the envelope and a count so the record stays parseable and honest.
+    return { ...envelope, [WORKFLOW_JOURNAL_OMITTED]: omitted.length };
+}

package/dist/core/workflow/proof.d.ts

@@ -1,6 +1,6 @@
 import type { RepoSnapshot } from "../context/index.js";
 import type { NormalizedPolicy, PolicyDecision, PolicyIsolation, PolicyNetworkAccess } from "../policy/index.js";
-import type { AcceptanceCriterion, AcceptanceResult, AcceptanceSummary, HarnessAttestationCitation, HarnessEvidenceCapability, ResultDigest, WorkflowAgentProof, WorkflowAttemptContext, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowProof, WorkflowWorkContext } from "./types.js";
+import type { AcceptanceCriterion, AcceptanceResult, AcceptanceSummary, HarnessAttestationCitation, HarnessEvidenceCapability, ResultDigest, WorkflowAgentProof, WorkflowAttemptContext, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowProof, WorkflowSandboxProjectionEvidence, WorkflowWorkContext } from "./types.js";
 import type { WorkspaceAttestation, WorkspaceBinding, WorkspaceUnsupportedExecutionEvidence } from "./workspaces/index.js";
 export interface NormalizedWorkflowMeta {
     name: string;
@@ -24,6 +24,8 @@ export interface BuildWorkflowProofInput {
     agents: WorkflowAgentProof[];
     evidence: WorkflowEvidenceRecord[];
     harnessEvidence?: Readonly<Record<string, HarnessEvidenceCapability | undefined>>;
+    /** Filesystem policy actually projected into children (ADR 0039). */
+    sandboxProjection?: WorkflowSandboxProjectionEvidence;
     /** Live attestations backing each harness's claims (ADR 0038). Injected by
      * the caller so proof stays free of filesystem lookups. */
     harnessAttestations?: Readonly<Record<string, HarnessAttestationCitation | undefined>>;

package/dist/core/workflow/proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/proof.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EAEzB,YAAY,EACZ,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,aAAa,EAIb,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAEhB,qCAAqC,EACtC,MAAM,uBAAuB,CAAC;AAoB/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IAClF;+DAC2D;IAC3D,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,GAAG,SAAS,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;QACrC,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,mBAAmB,CAAC;KACpC,CAAC;IACF,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,iBAAiB,CAAC,EAAE,qCAAqC,CAAC;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,sBAAsB,CAqCxB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CA6BzB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,EAAE,sBAAsB,EAAE,GACjC;IAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAuB9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAQjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,CAiDhF;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAO3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAgDjF;AA2BD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAoChE"}
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/proof.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EAEzB,YAAY,EACZ,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,aAAa,EAIb,iCAAiC,EACjC,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAEhB,qCAAqC,EACtC,MAAM,uBAAuB,CAAC;AAoB/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IAClF,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;IACtD;+DAC2D;IAC3D,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,GAAG,SAAS,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;QACrC,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,mBAAmB,CAAC;KACpC,CAAC;IACF,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,iBAAiB,CAAC,EAAE,qCAAqC,CAAC;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,sBAAsB,CAqCxB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CA6BzB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,EAAE,sBAAsB,EAAE,GACjC;IAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAuB9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAQjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,CAkDhF;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAO3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAgDjF;AA2BD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAoChE"}

package/dist/core/workflow/proof.js

@@ -146,6 +146,7 @@ export function buildWorkflowProof(input) {
             ? buildExecutionEvidence(input.status, input.workspaceBinding, input.workspaceAttestation)
             : input.workspaceFallback,
         repository,
+        ...(input.sandboxProjection ? { sandbox_projection: input.sandboxProjection } : {}),
         harnesses,
         unknowns,
         integrity: {

package/dist/core/workflow/sandbox-projection.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Project the host's filesystem policy into a harness's own vendor sandbox
+ * (ADR 0039).
+ *
+ * Harnery decides where a workflow child may write. Until this existed it never
+ * told the child, so a child working in a provider-owned Git worktree could
+ * edit files and could not commit: the vendor excludes a repository's
+ * administrative directory from its writable set by policy, and Harnery had no
+ * way to name it as an exception.
+ *
+ * The one rule that matters here is that a projection an adapter cannot
+ * represent is refused before launch. Passing a policy that gets silently
+ * dropped would leave an operator believing a child was constrained when it was
+ * not, which is worse than refusing and worse than never offering the feature.
+ */
+import type { HarnessSandboxProjection } from "../harnesses/types.js";
+import type { GitAdministrativeGrant, SpawnFilesystemPolicy } from "./types.js";
+import type { WorkspaceBinding } from "./workspaces/types.js";
+export declare class SandboxProjectionError extends Error {
+    readonly harness: string;
+    readonly reason: "mode_unrepresentable" | "writable_roots_unrepresentable" | "no_projection" | "writable_root_escapes_workspace" | "git_grant_unavailable";
+    constructor(harness: string, reason: SandboxProjectionError["reason"], message: string);
+}
+export interface ResolvedSandboxProjection {
+    /** Vendor-native name for the requested mode. */
+    nativeMode: string;
+    writableRoots: readonly string[];
+}
+/**
+ * Resolve a requested policy against what the adapter declares it can carry.
+ * Throws rather than degrading; see the module note.
+ */
+export declare function resolveSandboxProjection(harness: string, declaration: HarnessSandboxProjection | undefined, policy: SpawnFilesystemPolicy): ResolvedSandboxProjection;
+/**
+ * Refuse a projection that would grant write access outside the root the
+ * workspace provider already validated (ADR 0039).
+ *
+ * The renderer alone cannot do this: it never sees the binding. Granting a path
+ * the provider never sanctioned would let a projection quietly widen the blast
+ * radius of a run that the workspace lifecycle believes it has contained.
+ */
+export declare function assertProjectionWithinWorkspace(harness: string, allowedRootRealpath: string, writableRoots: readonly string[]): void;
+/**
+ * Resolve a named Git administrative grant into concrete writable roots
+ * (ADR 0040).
+ *
+ * These are the only paths a run may write outside its workspace, and the
+ * caller never names them: they come from the binding the provider verified.
+ * A caller-supplied path is checked by `assertProjectionWithinWorkspace` and can
+ * never reach here, so asking for the grant is the whole of the widening.
+ *
+ * In a linked worktree both halves of the administrative directory live under
+ * the source repository, and a commit needs the shared half regardless, so the
+ * grant returns both rather than pretending the private half is useful alone.
+ */
+export declare function resolveGitGrantRoots(grant: GitAdministrativeGrant, binding: WorkspaceBinding | undefined): readonly string[];
+//# sourceMappingURL=sandbox-projection.d.ts.map

package/dist/core/workflow/sandbox-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-projection.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/sandbox-projection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EACX,sBAAsB,GACtB,gCAAgC,GAChC,eAAe,GACf,iCAAiC,GACjC,uBAAuB,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM;CAMvF;AAED,MAAM,WAAW,yBAAyB;IACxC,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,wBAAwB,GAAG,SAAS,EACjD,MAAM,EAAE,qBAAqB,GAC5B,yBAAyB,CAoC3B;AASD;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,mBAAmB,EAAE,MAAM,EAC3B,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,IAAI,CAUN;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,sBAAsB,EAC7B,OAAO,EAAE,gBAAgB,GAAG,SAAS,GACpC,SAAS,MAAM,EAAE,CAanB"}

package/dist/core/workflow/sandbox-projection.js

@@ -0,0 +1,95 @@
+/**
+ * Project the host's filesystem policy into a harness's own vendor sandbox
+ * (ADR 0039).
+ *
+ * Harnery decides where a workflow child may write. Until this existed it never
+ * told the child, so a child working in a provider-owned Git worktree could
+ * edit files and could not commit: the vendor excludes a repository's
+ * administrative directory from its writable set by policy, and Harnery had no
+ * way to name it as an exception.
+ *
+ * The one rule that matters here is that a projection an adapter cannot
+ * represent is refused before launch. Passing a policy that gets silently
+ * dropped would leave an operator believing a child was constrained when it was
+ * not, which is worse than refusing and worse than never offering the feature.
+ */
+export class SandboxProjectionError extends Error {
+    harness;
+    reason;
+    constructor(harness, reason, message) {
+        super(message);
+        this.name = "SandboxProjectionError";
+        this.harness = harness;
+        this.reason = reason;
+    }
+}
+/**
+ * Resolve a requested policy against what the adapter declares it can carry.
+ * Throws rather than degrading; see the module note.
+ */
+export function resolveSandboxProjection(harness, declaration, policy) {
+    if (!declaration) {
+        throw new SandboxProjectionError(harness, "no_projection", `${harness} cannot project a filesystem policy into its sandbox; remove the policy or use a harness that can`);
+    }
+    const nativeMode = declaration.modes[policy.mode];
+    if (!nativeMode) {
+        throw new SandboxProjectionError(harness, "mode_unrepresentable", `${harness} does not distinguish the "${policy.mode}" filesystem mode, so it cannot be enforced`);
+    }
+    const writableRoots = policy.writableRoots ?? [];
+    if (writableRoots.length > 0 && !declaration.writableRoots) {
+        throw new SandboxProjectionError(harness, "writable_roots_unrepresentable", `${harness} does not accept an explicit writable-root set, so ${writableRoots.length} declared path(s) could not be enforced`);
+    }
+    for (const root of writableRoots) {
+        // Relative paths cannot be validated against the provider's roots and are
+        // resolved differently by every vendor, so they are refused outright.
+        if (typeof root !== "string" || !root.startsWith("/")) {
+            throw new SandboxProjectionError(harness, "writable_roots_unrepresentable", `writable root ${JSON.stringify(root)} must be an absolute path`);
+        }
+    }
+    return { nativeMode, writableRoots };
+}
+/** True when `candidate` is `root` or lies beneath it, comparing whole path
+ * segments so `/a/bc` is not treated as inside `/a/b`. */
+function isWithin(root, candidate) {
+    const normalizedRoot = root.endsWith("/") ? root.slice(0, -1) : root;
+    return candidate === normalizedRoot || candidate.startsWith(`${normalizedRoot}/`);
+}
+/**
+ * Refuse a projection that would grant write access outside the root the
+ * workspace provider already validated (ADR 0039).
+ *
+ * The renderer alone cannot do this: it never sees the binding. Granting a path
+ * the provider never sanctioned would let a projection quietly widen the blast
+ * radius of a run that the workspace lifecycle believes it has contained.
+ */
+export function assertProjectionWithinWorkspace(harness, allowedRootRealpath, writableRoots) {
+    for (const root of writableRoots) {
+        if (!isWithin(allowedRootRealpath, root)) {
+            throw new SandboxProjectionError(harness, "writable_root_escapes_workspace", `writable root ${JSON.stringify(root)} is outside the workspace root ${JSON.stringify(allowedRootRealpath)} the provider validated`);
+        }
+    }
+}
+/**
+ * Resolve a named Git administrative grant into concrete writable roots
+ * (ADR 0040).
+ *
+ * These are the only paths a run may write outside its workspace, and the
+ * caller never names them: they come from the binding the provider verified.
+ * A caller-supplied path is checked by `assertProjectionWithinWorkspace` and can
+ * never reach here, so asking for the grant is the whole of the widening.
+ *
+ * In a linked worktree both halves of the administrative directory live under
+ * the source repository, and a commit needs the shared half regardless, so the
+ * grant returns both rather than pretending the private half is useful alone.
+ */
+export function resolveGitGrantRoots(grant, binding) {
+    if (grant === "none")
+        return [];
+    const repository = binding?.repository;
+    if (!repository) {
+        throw new SandboxProjectionError("workflow", "git_grant_unavailable", `gitWrite "${grant}" needs a Git repository binding; this run has ${binding ? "a workspace with no repository" : "no isolated workspace"}`);
+    }
+    // Deduplicated: a full-clone topology reports the same path for both, and a
+    // repeated writable root is noise in the rendered argv and in proof.
+    return [...new Set([repository.gitdir.realpath, repository.common_dir.realpath])];
+}

package/dist/core/workflow/spawn-claude.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-claude.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-claude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAIjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAYrE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAc1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAgDxE;AAED,eAAO,MAAM,iBAAiB,EAAE,OAc/B,CAAC"}
+{"version":3,"file":"spawn-claude.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-claude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAKjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAYrE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAsB1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAwDxE;AAED,eAAO,MAAM,iBAAiB,EAAE,OAc/B,CAAC"}

package/dist/core/workflow/spawn-claude.js

@@ -18,12 +18,17 @@
  *    (stop-hook.ts), keeping heartbeats + events on.
  */
 import { exec } from "../../lib/exec.js";
-import { validateHarnessEffort } from "../harnesses/profiles.js";
+import { builtinHarnessProfile, validateHarnessEffort } from "../harnesses/profiles.js";
 import { buildChildEnv } from "./child-env.js";
 import { notFoundError } from "./harnesses.js";
+import { resolveSandboxProjection } from "./sandbox-projection.js";
 import { vendorFailureText } from "./spawn-failure.js";
 export function buildClaudeInvocation(req) {
     validateHarnessEffort("claude-code", req.effort);
+    if (req.filesystemPolicy) {
+        // Declared unrepresentable: refuse rather than drop it silently (ADR 0039).
+        resolveSandboxProjection("claude-code", builtinHarnessProfile("claude-code")?.sandboxProjection, req.filesystemPolicy);
+    }
     const argv = [
         "claude",
         "-p",
@@ -40,6 +45,14 @@ export function buildClaudeInvocation(req) {
     return { argv };
 }
 export function normalizeClaudeResult(raw) {
+    if (raw.timedOut) {
+        return {
+            ok: false,
+            text: "",
+            durationMs: raw.durationMs,
+            error: `claude timed out after ${raw.durationMs}ms and was killed`,
+        };
+    }
     if (raw.exitCode === 127) {
         return {
             ok: false,

package/dist/core/workflow/spawn-codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-codex.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAIjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAgB9F;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAiBvE;AAED,eAAO,MAAM,YAAY,EAAE,OA2B1B,CAAC"}
+{"version":3,"file":"spawn-codex.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAKjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,CA8B9F;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAyBvE;AAED,eAAO,MAAM,YAAY,EAAE,OA2B1B,CAAC"}

package/dist/core/workflow/spawn-codex.js

@@ -19,14 +19,19 @@ import { existsSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { exec } from "../../lib/exec.js";
-import { validateHarnessEffort } from "../harnesses/profiles.js";
+import { builtinHarnessProfile, validateHarnessEffort } from "../harnesses/profiles.js";
 import { buildChildEnv } from "./child-env.js";
 import { notFoundError } from "./harnesses.js";
+import { resolveSandboxProjection } from "./sandbox-projection.js";
 import { vendorFailureText } from "./spawn-failure.js";
 export function buildCodexInvocation(req, resultFile) {
     validateHarnessEffort("codex", req.effort);
     if (!resultFile)
         throw new Error("codex adapter requires a final-message result file");
+    // Default stays workspace-write so an unprojected request is unchanged.
+    const projection = req.filesystemPolicy
+        ? resolveSandboxProjection("codex", builtinHarnessProfile("codex")?.sandboxProjection, req.filesystemPolicy)
+        : undefined;
     const argv = [
         "codex",
         "exec",
@@ -35,8 +40,11 @@ export function buildCodexInvocation(req, resultFile) {
         resultFile,
         "--skip-git-repo-check",
         "--sandbox",
-        "workspace-write",
+        projection?.nativeMode ?? "workspace-write",
     ];
+    if (projection && projection.writableRoots.length > 0) {
+        argv.push("-c", `sandbox_workspace_write.writable_roots=${JSON.stringify(projection.writableRoots)}`);
+    }
     if (req.model)
         argv.push("--model", req.model);
     if (req.effort)
@@ -44,6 +52,14 @@ export function buildCodexInvocation(req, resultFile) {
     return { argv, resultFile };
 }
 export function normalizeCodexResult(raw) {
+    if (raw.timedOut) {
+        return {
+            ok: false,
+            text: "",
+            durationMs: raw.durationMs,
+            error: `codex timed out after ${raw.durationMs}ms and was killed`,
+        };
+    }
     if (raw.exitCode === 127) {
         return { ok: false, text: "", durationMs: raw.durationMs, error: notFoundError("codex") };
     }

package/dist/core/workflow/spawn-cursor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-cursor.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAIjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASrE,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAWA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAU1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CA6BxE;AAED,eAAO,MAAM,aAAa,EAAE,OAe3B,CAAC"}
+{"version":3,"file":"spawn-cursor.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAKjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASrE,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAWA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAkB1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAqCxE;AAED,eAAO,MAAM,aAAa,EAAE,OAe3B,CAAC"}