headlesscode 1.2.2 → 1.3.0

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/Capsize-Games/headlesscode/actions/workflows/ci.yml/badge.svg)](https://github.com/Capsize-Games/headlesscode/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/headlesscode?logo=npm)](https://www.npmjs.com/package/headlesscode)
-[![Node.js >=18](https://img.shields.io/badge/node-%3E%3D18-339933?logo=node.js&logoColor=white)](https://nodejs.org/)
+[![Node.js >=22.19](https://img.shields.io/badge/node-%3E%3D22.19-339933?logo=node.js&logoColor=white)](https://nodejs.org/)
 [![License: Apache-2.0](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](./LICENSE)
 
 `headlesscode` runs the Zoo Code agent loop from a Node.js process, without a
@@ -38,7 +38,7 @@ monitoring.
 
 ## Quick start
 
-Requires Node.js 18 or newer. Install globally or run with `npx`:
+Requires Node.js 22.19 or newer. Install globally or run with `npx`:
 
 ```bash
 npm install -g headlesscode
@@ -194,29 +194,59 @@ and each subcommand's `--help` for complete usage.
 
 ## Recursive self-improvement
 
-`headlesscode improve` runs a bounded experiment against an external evaluator.
-The supervisor creates candidate worktrees, asks the local Ollama worker to
-make focused changes, runs regression and visible/hidden evaluations, and
-keeps selection state outside candidate worktrees. Each generation produces a
-report for human review.
+`headlesscode improve --dry-run` resolves the base commit and prints planned
+candidate worktrees. A real run requires PostgreSQL, a shared S3-compatible
+artifact store, and at least one registered `headlesscode rsi-worker`. The
+coordinator queues sanitized mutation snapshots and visible evaluation jobs;
+workers run each in a fresh OpenShell guest. Fitness, paired baseline
+comparison, archives, and selection stay in the coordinator. Hidden evaluation
+remains disabled. A 2026-09-29 bounded run used two workers on the same local
+OpenShell gateway; both candidate evaluation jobs were leased concurrently.
+The run used a temporary `clamp.js` fixture and does not establish general
+headlesscode improvement or multi-gateway operation. An earlier bounded run
+passed visible checks but made no source change and was rejected.
 
 ```bash
 npx tsx src/cli.ts improve --repo . --dry-run
 npx tsx src/cli.ts improve --repo . --population 2 --generations 1
 ```
 
-This loop does not yet train adapters, schedule multiple trajectories, or
-provide OS-level candidate isolation. Follow-up work is tracked as:
+Before starting workers, build the standard and RSI guest images on each
+OpenShell gateway host that will run RSI jobs. Build the larger training image
+only on gateways whose workers will accept model-training or paired
+model-evaluation jobs:
+
+```bash
+docker build -f docker/OpenShell.Dockerfile -t headlesscode-openshell:local .
+docker build -f docker/OpenShell-RSI.Dockerfile -t headlesscode-openshell-rsi:local .
+docker build -f docker/OpenShell-RSI-Training.Dockerfile -t headlesscode-openshell-rsi-training:local .
+```
+
+The RSI Dockerfile extends `headlesscode-openshell:local` and removes the RSI
+source, test files, and hidden evaluation suite from the guest image. See the [RSI design](./docs/recursive-self-improvement.md)
+for worker and queue configuration.
+
+The queue stores job state, worker registrations, leases, retries, and admission
+policy in PostgreSQL; artifact bytes remain in object storage. Local integration
+tests used 12 simulated workers and 100 queued jobs, including a 20 MiB artifact. Each
+worker process currently runs one guest at a time and must be configured with a
+unique worker ID and OpenShell gateway ID. The two-worker run observed 4.008
+seconds of concurrent evaluation leases on one gateway. A local PostgreSQL/
+RustFS test drained the remaining 96 jobs with 12 simulated workers in 446 ms
+(215.2 jobs/s), after the initial four jobs were claimed and completed to
+verify admission limits;
+claims still serialize on a queue-policy row, and neither result qualifies a
+multi-host deployment. Remaining work is:
 
 | Issue | Work |
 | --- | --- |
-| [#3](https://github.com/Capsize-Games/headlesscode/issues/3) | OS-level candidate sandbox |
-| [#4](https://github.com/Capsize-Games/headlesscode/issues/4) | Cryptographically verifiable evaluator and artifacts |
-| [#5](https://github.com/Capsize-Games/headlesscode/issues/5) | Resource-aware resumable scheduler |
-| [#6](https://github.com/Capsize-Games/headlesscode/issues/6) | Adaptive multi-trajectory search |
-| [#7](https://github.com/Capsize-Games/headlesscode/issues/7) | Validated curriculum fixtures |
-| [#8](https://github.com/Capsize-Games/headlesscode/issues/8) | Adversarial evaluation and cross-model supervision |
-| [#9](https://github.com/Capsize-Games/headlesscode/issues/9) | Real LoRA or QLoRA backend |
+| [#3](https://github.com/Capsize-Games/headlesscode/issues/3) | OpenShell candidate isolation is implemented; live multi-gateway qualification remains. |
+| [#4](https://github.com/Capsize-Games/headlesscode/issues/4) | Content-addressed artifacts are implemented; signed evaluator provenance and hidden evaluation remain. |
+| [#5](https://github.com/Capsize-Games/headlesscode/issues/5) | PostgreSQL queue, leases, retries, admission, and configured workers are implemented; live fleet qualification remains. |
+| [#6](https://github.com/Capsize-Games/headlesscode/issues/6) | Bounded adaptive independent search supports an initial population plus one evidence-driven follow-up; repeated stages remain out of scope. |
+| [#7](https://github.com/Capsize-Games/headlesscode/issues/7) | Fixture-backed curriculum replay and explicit promotion are implemented; wording-to-capability measurement remains unproven. |
+| [#8](https://github.com/Capsize-Games/headlesscode/issues/8) | Adversarial review and bounded OpenShell break tests are implemented; live provider-backed review is unvalidated. |
+| [#9](https://github.com/Capsize-Games/headlesscode/issues/9) | An OpenShell QLoRA prototype is covered by mocked job tests; the supplied GGUF is rejected before enqueue, and no live training is validated. |
 
 See the [RSI design](./docs/recursive-self-improvement.md) and
 [run progress](./docs/rsi-progress.md).

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "headlesscode",
-	"version": "1.2.2",
+	"version": "1.3.0",
 	"description": "Standalone headless coding-agent harness: runs the Zoo Code agent loop (prompts, tools, modes) without a VS Code UI, driven by CLI, HTTP, and parallel worktree orchestration.",
 	"license": "Apache-2.0",
 	"repository": {
@@ -17,7 +17,7 @@
 	],
 	"type": "module",
 	"engines": {
-		"node": ">=18"
+		"node": ">=22.19"
 	},
 	"bin": {
 		"headlesscode": "bin/headlesscode.mjs"
@@ -42,14 +42,17 @@
 		"start": "tsx src/cli.ts",
 		"cli": "tsx src/cli.ts",
 		"monitor:pilot": "tsx scripts/monitor-pilot/run.ts",
+		"rsi:promote-curriculum": "tsx src/rsi/promote-curriculum.ts",
 		"test": "node scripts/run-tests.mjs",
 		"prepublishOnly": "npm ci && npm test"
 	},
 	"dependencies": {
+		"@aws-sdk/client-s3": "^3.1142.0",
 		"@modelcontextprotocol/sdk": "^1.30.0",
 		"@octokit/auth-app": "^8.2.0",
 		"fastest-levenshtein": "^1.0.16",
 		"p-wait-for": "^5.0.2",
+		"pg": "^8.23.0",
 		"playwright": "^1.62.1",
 		"simple-git": "^3.36.0",
 		"tsx": "^4.19.0",
@@ -59,6 +62,7 @@
 		"zod": "^3.25.76"
 	},
 	"devDependencies": {
-		"@types/node": "^22.10.0"
+		"@types/node": "^22.10.0",
+		"@types/pg": "^8.23.1"
 	}
 }

package/src/cli.ts

@@ -43,7 +43,6 @@ import { analyzeCliMain } from "./orchestrator/analyze-cli.js"
 import { costHistoryCliMain } from "./orchestrator/cost-history-cli.js"
 import { resolvePermissions, type PermissionsConfig } from "./permissions/config.js"
 import { resolveModelForMode, resolveReasoningEffortForMode } from "./config/mode-models.js"
-import { improveMain } from "./rsi/controller.js"
 import { openShellSessionMain } from "./cloud/openshell-session.js"
 
 const VERSION = "0.1.0"
@@ -751,10 +750,47 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<numb
 	if (argv[0] === "openshell-session") {
 		return openShellSessionMain(argv.slice(1))
 	}
+	if (argv[0] === "rsi-worker") {
+		const { rsiWorkerMain } = await import("./rsi/worker.js")
+		return rsiWorkerMain()
+	}
+	if (argv[0] === "rsi-train-model") {
+		const { parseRsiArgs } = await import("./rsi/config.js")
+		const { readArchive } = await import("./rsi/archive.js")
+		const { PostgresRsiJobQueue, fleetQueuePolicy } = await import("./rsi/postgres-queue.js")
+		const { runBoundedModelCandidate } = await import("./rsi/model-training.js")
+		const parsed = parseRsiArgs(argv.slice(1))
+		if (parsed.help) {
+			process.stdout.write("Usage: headlesscode rsi-train-model --repo <path> --archive-dir <path> --resume <run-id> --model-candidate-id <id>\nThe registered worker must use an OpenShell training image and a local Hugging Face checkpoint.\n")
+			return 0
+		}
+		if (parsed.error || !parsed.config || !parsed.config.resumeRunId || !parsed.config.modelCandidateId || parsed.config.dryRun) {
+			process.stderr.write(`headlesscode rsi-train-model: ${parsed.error ?? "--resume and --model-candidate-id are required; dry-run is unsupported"}\n`)
+			return 2
+		}
+		const config = parsed.config
+		const archive = await readArchive(config.archiveDir)
+		const run = archive.activeRuns.find((entry) => entry.runId === config.resumeRunId) ?? archive.runs.find((entry) => entry.runId === config.resumeRunId)
+		if (!run) {
+			process.stderr.write(`headlesscode rsi-train-model: RSI run not found in ${config.archiveDir}\n`)
+			return 2
+		}
+		const policy = fleetQueuePolicy(process.env.HEADLESSCODE_RSI_QUEUE_NAME?.trim() || "rsi-default", config.maxConcurrent, process.env)
+		const queue = PostgresRsiJobQueue.fromEnvironment(policy, process.env)
+		try {
+			await queue.migrate()
+			const model = await runBoundedModelCandidate(config, run, queue, config.modelCandidateId!)
+			process.stdout.write(`[rsi-model] ${model.id}: ${model.status}; eligible=${model.eligibleForSelection === true}\n`)
+			return model.eligibleForSelection ? 0 : 1
+		} finally {
+			await queue.close()
+		}
+	}
 	// Bounded recursive self-improvement: the supervisor owns the evaluator,
 	// archive, and selection logic while each candidate runs in its own
 	// worktree. See docs/recursive-self-improvement.md.
 	if (argv[0] === "improve") {
+		const { improveMain } = await import("./rsi/controller.js")
 		return improveMain(argv.slice(1))
 	}
 
@@ -1049,9 +1085,17 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<numb
 		}
 	}
 
-	// ── real run: API key required ────────────────────────────────────────────
+	// ── real run: OpenRouter key required unless this mode is local ────────────
+	const codeModeBackend = process.env.HEADLESSCODE_CODE_MODE_BACKEND ?? "openrouter"
+	const localBackendModes = new Set(
+		(process.env.HEADLESSCODE_LOCAL_BACKEND_MODES ?? "code")
+			.split(",")
+			.map((s) => s.trim())
+			.filter(Boolean),
+	)
+	const useLocalCodeBackend = localBackendModes.has(options.mode) && codeModeBackend === "ollama"
 	const apiKey = process.env.HEADLESSCODE_OPENROUTER_API_KEY
-	if (!apiKey) {
+	if (!apiKey && !useLocalCodeBackend) {
 		process.stderr.write(
 			"headlesscode: HEADLESSCODE_OPENROUTER_API_KEY is not set.\n" +
 				"  Export it (e.g. export HEADLESSCODE_OPENROUTER_API_KEY=sk-or-...) or use --dry-run to\n" +
@@ -1098,21 +1142,6 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<numb
 		env: process.env,
 	})
 
-	// Generalized 2026-08-21 (issue #142) beyond the original `code`-only
-	// scope (plans/local-dual-model-code-agent.md, D2) — real need: two
-	// separate local daemons on two different GPUs (a coder model and a
-	// review model), each needing its own mode -> URL/model mapping.
-	// HEADLESSCODE_LOCAL_BACKEND_MODES defaults to "code" alone, so
-	// nobody's existing setup changes behavior unless they opt in.
-	const codeModeBackend = process.env.HEADLESSCODE_CODE_MODE_BACKEND ?? "openrouter"
-	const localBackendModes = new Set(
-		(process.env.HEADLESSCODE_LOCAL_BACKEND_MODES ?? "code")
-			.split(",")
-			.map((s) => s.trim())
-			.filter(Boolean),
-	)
-	const useLocalCodeBackend = localBackendModes.has(options.mode) && codeModeBackend === "ollama"
-
 	// The local daemon's own proxy (ollama_shim.py) deliberately runs a 600s
 	// upstream request timeout — its own comment documents why: a shorter
 	// shim timeout was once found to cut off calls before the harness's own

package/src/cloud/openshell-preflight.ts

@@ -1,10 +1,10 @@
 import { spawnSync } from "node:child_process"
 import * as fs from "node:fs"
 
-export function openshellPreflight(): string | undefined {
+export function openshellPreflight(options: { requireOpenRouterCredential?: boolean } = {}): string | undefined {
 	const policy = process.env.HEADLESSCODE_OPENSHELL_POLICY
 	if (!policy || !fs.existsSync(policy)) return "set HEADLESSCODE_OPENSHELL_POLICY to an existing base policy YAML"
-	if (!process.env.HEADLESSCODE_OPENROUTER_API_KEY) return "set HEADLESSCODE_OPENROUTER_API_KEY so OpenShell can provide the imported credential profile"
+	if (options.requireOpenRouterCredential !== false && !process.env.HEADLESSCODE_OPENROUTER_API_KEY) return "set HEADLESSCODE_OPENROUTER_API_KEY so OpenShell can provide the imported credential profile"
 	const version = spawnSync("openshell", ["--version"], { encoding: "utf8", timeout: 5000 })
 	if (version.error || version.status !== 0) return "OpenShell CLI is unavailable"
 	const gateway = spawnSync("openshell", ["gateway", "info"], { encoding: "utf8", timeout: 10000 })

package/src/cloud/openshell-provider.ts

@@ -59,12 +59,24 @@ export interface OpenShellSessionProviderOptions {
 	image?: string
 	policy?: string
 	providers?: string[]
+	/** Attach automatically discovered host provider profiles to the sandbox. */
+	autoProviders?: boolean
 	cpu?: string
 	memory?: string
 	namePrefix?: string
 	readOnlyMounts?: Array<{ source: string; target: string }>
 	importResults?: boolean
 	scratchRoot?: string
+	/** Omit project/shared data snapshots for experiments that must not inherit operator context. */
+	includeProjectData?: boolean
+	/** Use a guest-safe identity path instead of the supervisor checkout path. */
+	projectIdentityRoot?: string
+	/** Additional exact OpenShell network rules needed by the workload. */
+	networkPolicy?: Record<string, unknown>
+	/** Timeout for sandbox commands, including agent mutation. */
+	commandTimeoutMs?: number
+	/** Number of GPU devices requested for a training-only sandbox. */
+	gpu?: number
 	run?: (args: string[], timeoutMs?: number) => CommandResult
 	listSandboxes?: () => string[]
 }
@@ -74,6 +86,7 @@ export class OpenShellSessionProvider implements CloudProvider {
 	private readonly image: string
 	private readonly policy?: string
 	private readonly providers: string[]
+	private readonly autoProviders: boolean
 	private readonly cpu: string
 	private readonly memory: string
 	private readonly namePrefix: string
@@ -82,18 +95,30 @@ export class OpenShellSessionProvider implements CloudProvider {
 	private readonly listSandboxes: () => string[]
 	private readonly importResults: boolean
 	private readonly scratchRoot: string
+	private readonly includeProjectData: boolean
+	private readonly projectIdentityRoot?: string
+	private readonly networkPolicy: Record<string, unknown>
+	private readonly commandTimeoutMs: number
+	private readonly gpu?: number
 	private readonly workspaces = new Map<string, OpenShellWorkspaceState>()
 
 	constructor(options: OpenShellSessionProviderOptions = {}) {
 		this.image = options.image ?? process.env.HEADLESSCODE_OPENSHELL_IMAGE ?? "headlesscode-openshell:local"
 		this.policy = options.policy ?? process.env.HEADLESSCODE_OPENSHELL_POLICY
 		this.providers = options.providers ?? (process.env.HEADLESSCODE_OPENSHELL_PROVIDERS ?? "headlesscode-openrouter").split(",").map((name) => name.trim()).filter(Boolean)
+		this.autoProviders = options.autoProviders ?? true
 		this.cpu = options.cpu ?? process.env.HEADLESSCODE_OPENSHELL_CPU ?? "2"
 		this.memory = options.memory ?? process.env.HEADLESSCODE_OPENSHELL_MEMORY ?? "4Gi"
 		this.namePrefix = options.namePrefix ?? process.env.HEADLESSCODE_OPENSHELL_NAME_PREFIX ?? "hcls"
 		this.readOnlyMounts = options.readOnlyMounts ?? []
 		this.importResults = options.importResults ?? true
 		this.scratchRoot = path.resolve(options.scratchRoot ?? process.env.HEADLESSCODE_OPENSHELL_SCRATCH_ROOT ?? path.join(os.homedir(), ".local", "share", "headlesscode", "openshell-sessions"))
+		this.includeProjectData = options.includeProjectData ?? true
+		this.projectIdentityRoot = options.projectIdentityRoot
+		this.networkPolicy = options.networkPolicy ?? {}
+		this.commandTimeoutMs = options.commandTimeoutMs ?? 15 * 60_000
+		if (options.gpu !== undefined && (!Number.isInteger(options.gpu) || options.gpu < 1 || options.gpu > 8)) throw new Error("OpenShell GPU count must be an integer from 1 to 8")
+		this.gpu = options.gpu
 		this.run = options.run ?? ((args, timeoutMs) => {
 			const result = spawnSync("openshell", args, { encoding: "utf8", maxBuffer: 64 * 1024 * 1024, timeout: timeoutMs })
 			return { exitCode: result.status ?? 1, output: `${result.stdout ?? ""}${result.stderr ?? ""}`.trim() }
@@ -258,7 +283,8 @@ export class OpenShellSessionProvider implements CloudProvider {
 	): Promise<SessionHandle> {
 		const { sandboxWorkspace } = isolated
 		if (!this.policy || !fs.existsSync(this.policy)) throw new Error("OpenShell requires a base policy file")
-		const args = ["sandbox", "create", "--detach", "--auto-providers", "--cpu", this.cpu, "--memory", this.memory, "--name", name, "--from", this.image]
+		const args = ["sandbox", "create", "--detach", this.autoProviders ? "--auto-providers" : "--no-auto-providers", "--cpu", this.cpu, "--memory", this.memory, "--name", name, "--from", this.image]
+		if (this.gpu !== undefined) args.push("--gpu", String(this.gpu))
 		if (this.policy) args.push("--policy", path.resolve(this.policy))
 		for (const provider of this.providers) args.push("--provider", provider)
 		// Only the disposable clone is writable inside the sandbox. Host Git
@@ -268,13 +294,7 @@ export class OpenShellSessionProvider implements CloudProvider {
 			{ type: "bind", source: sandboxWorkspace, target: OPENSHELL_WORKSPACE_TARGET, read_only: false },
 			{ type: "bind", source: isolated.exportDir, target: "/result", read_only: false },
 		]
-		const projectData = resolveProjectDataDir(repo)
-		const projectDataTarget = "/opt/headlesscode-data/projects/" + path.basename(projectData)
 		const dataSnapshotRoot = path.join(isolated.tempRoot, "data")
-		const projectDataSnapshot = path.join(dataSnapshotRoot, "projects", path.basename(projectData))
-		fs.mkdirSync(path.dirname(projectDataSnapshot), { recursive: true })
-		fs.cpSync(projectData, projectDataSnapshot, { recursive: true, dereference: true })
-		mounts.push({ type: "bind", source: projectDataSnapshot, target: projectDataTarget, read_only: true })
 		const policy = this.policy ? parse(fs.readFileSync(this.policy, "utf8")) as Record<string, any> : undefined
 		const filesystemPolicy = policy?.filesystem_policy
 		if (!filesystemPolicy || !Array.isArray(filesystemPolicy.read_only) || !Array.isArray(filesystemPolicy.read_write)) {
@@ -282,18 +302,33 @@ export class OpenShellSessionProvider implements CloudProvider {
 		}
 		filesystemPolicy.read_write.push(OPENSHELL_WORKSPACE_TARGET)
 		filesystemPolicy.read_write.push("/result")
-		filesystemPolicy.read_only.push(projectDataTarget, OPENSHELL_HARNESS_ROOT)
-		const sharedData = path.join(projectStoreRoot(), "shared")
-		if (fs.existsSync(sharedData)) {
-			const sharedDataSnapshot = path.join(dataSnapshotRoot, "shared")
-			fs.cpSync(sharedData, sharedDataSnapshot, { recursive: true, dereference: true })
-			mounts.push({ type: "bind", source: sharedDataSnapshot, target: "/opt/headlesscode-data/shared", read_only: true })
-			filesystemPolicy.read_only.push("/opt/headlesscode-data/shared")
+		policy.network_policies = { ...(policy.network_policies ?? {}), ...this.networkPolicy }
+		filesystemPolicy.read_only.push(OPENSHELL_HARNESS_ROOT)
+		let projectDataMounted = false
+		if (this.includeProjectData) {
+			const projectData = resolveProjectDataDir(repo)
+			if (fs.existsSync(projectData)) {
+				const projectDataTarget = "/opt/headlesscode-data/projects/" + path.basename(projectData)
+				const projectDataSnapshot = path.join(dataSnapshotRoot, "projects", path.basename(projectData))
+				fs.mkdirSync(path.dirname(projectDataSnapshot), { recursive: true })
+				fs.cpSync(projectData, projectDataSnapshot, { recursive: true, dereference: true })
+				mounts.push({ type: "bind", source: projectDataSnapshot, target: projectDataTarget, read_only: true })
+				filesystemPolicy.read_only.push(projectDataTarget)
+				projectDataMounted = true
+			}
+			const sharedData = path.join(projectStoreRoot(), "shared")
+			if (fs.existsSync(sharedData)) {
+				const sharedDataSnapshot = path.join(dataSnapshotRoot, "shared")
+				fs.cpSync(sharedData, sharedDataSnapshot, { recursive: true, dereference: true })
+				mounts.push({ type: "bind", source: sharedDataSnapshot, target: "/opt/headlesscode-data/shared", read_only: true })
+				filesystemPolicy.read_only.push("/opt/headlesscode-data/shared")
+			}
 		}
 		const checkpointsSnapshot = path.join(dataSnapshotRoot, "checkpoints")
 		fs.mkdirSync(checkpointsSnapshot, { recursive: true })
 		mounts.push({ type: "bind", source: checkpointsSnapshot, target: "/opt/headlesscode-data/checkpoints", read_only: false })
-		filesystemPolicy.read_only.push("/opt/headlesscode-data")
+		if (projectDataMounted) filesystemPolicy.read_only.push("/opt/headlesscode-data")
+		else filesystemPolicy.read_write.push("/opt/headlesscode-data")
 		filesystemPolicy.read_write.push("/opt/headlesscode-data/checkpoints")
 		const memoryDir = request.env?.HEADLESSCODE_MEMORY_DIR
 		if (memoryDir) {
@@ -312,12 +347,13 @@ export class OpenShellSessionProvider implements CloudProvider {
 			mounts.push({ type: "bind", source: memorySnapshot, target: "/opt/headlesscode-memory", read_only: false })
 			filesystemPolicy.read_write.push("/opt/headlesscode-memory")
 		}
-		for (const mount of this.readOnlyMounts) {
-			const relativeTarget = path.relative(OPENSHELL_WORKSPACE_TARGET, path.resolve(mount.target))
-			if (relativeTarget.startsWith("..") || path.isAbsolute(relativeTarget)) throw new Error(`OpenShell read-only mount target must be under ${OPENSHELL_WORKSPACE_TARGET}: ${mount.target}`)
-			const target = path.join(sandboxWorkspace, relativeTarget)
-			fs.mkdirSync(path.dirname(target), { recursive: true })
-			fs.cpSync(path.resolve(mount.source), target, { recursive: true, dereference: true })
+		const mountTargets = validateReadOnlyMountTargets(this.readOnlyMounts)
+		for (const [index, mount] of this.readOnlyMounts.entries()) {
+			const sourceSnapshot = path.join(isolated.tempRoot, "read-only-mounts", String(index))
+			fs.mkdirSync(path.dirname(sourceSnapshot), { recursive: true, mode: 0o700 })
+			fs.cpSync(path.resolve(mount.source), sourceSnapshot, { recursive: true, dereference: true })
+			mounts.push({ type: "bind", source: sourceSnapshot, target: mountTargets[index]!, read_only: true })
+			filesystemPolicy.read_only.push(mountTargets[index]!)
 		}
 		const generatedPolicy = path.join(os.tmpdir(), `headlesscode-openshell-policy-${process.pid}-${Date.now()}.yaml`)
 		fs.writeFileSync(generatedPolicy, stringify(policy), { mode: 0o600 })
@@ -327,13 +363,13 @@ export class OpenShellSessionProvider implements CloudProvider {
 			if (key === "HEADLESSCODE_MEMORY_DIR" && isolated.memorySnapshot) args.push("--env", "HEADLESSCODE_MEMORY_DIR=/opt/headlesscode-memory")
 			else if (key !== "TARGET_REPO") args.push("--env", `${key}=${value}`)
 		}
-		args.push("--env", `TARGET_REPO=${OPENSHELL_WORKSPACE_TARGET}`, "--env", `HEADLESSCODE_ROOT=${OPENSHELL_HARNESS_ROOT}`, "--env", "HEADLESSCODE_DATA_DIR=/opt/headlesscode-data", "--env", `HEADLESSCODE_PROJECT_IDENTITY_ROOT=${repo}`, "--env", "GIT_CONFIG_NOSYSTEM=1", "--env", "GIT_CONFIG_GLOBAL=/dev/null")
+		args.push("--env", `TARGET_REPO=${OPENSHELL_WORKSPACE_TARGET}`, "--env", `HEADLESSCODE_ROOT=${OPENSHELL_HARNESS_ROOT}`, "--env", "HEADLESSCODE_DATA_DIR=/opt/headlesscode-data", "--env", `HEADLESSCODE_PROJECT_IDENTITY_ROOT=${this.projectIdentityRoot ?? repo}`, "--env", "GIT_CONFIG_NOSYSTEM=1", "--env", "GIT_CONFIG_GLOBAL=/dev/null")
 		args.push("--", "sleep", "infinity")
 		this.workspaces.set(name, isolated)
 		writeOpenShellSandboxMarker(hostWorkspace, name)
 		let result: CommandResult
 		try {
-			result = this.run(args)
+			result = this.run(args, this.commandTimeoutMs)
 		} finally {
 			fs.rmSync(generatedPolicy, { force: true })
 		}
@@ -403,7 +439,7 @@ export class OpenShellSessionProvider implements CloudProvider {
 				"for f in /workspace/.harness.* /workspace/.qa.* /workspace/.review.*; do [ -e \"$f\" ] || continue; rel=\"${f#/workspace/}\"; [ -z \"$(git ls-files -- \"$rel\")\" ] && rm -f -- \"$f\"; done",
 				"git ls-files -z -- .env '.env.*' | while IFS= read -r -d '' rel; do git show \"HEAD:$rel\" > \"/workspace/$rel\"; done",
 				"for f in /workspace/.env /workspace/.env.*; do [ -e \"$f\" ] || continue; rel=\"${f#/workspace/}\"; git ls-files --error-unmatch -- \"$rel\" >/dev/null 2>&1 || rm -f -- \"$f\"; done",
-				"git add -A",
+				"git rm -r --cached --ignore-unmatch -- .rsi-base-model && git add -A -- . ':!.rsi-base-model'",
 				"if ! git diff --cached --quiet HEAD; then git -c core.hooksPath=/dev/null commit -m 'HeadlessCode sandbox result'; fi",
 				`git bundle create /result/result.bundle ${branchRef}`,
 			].join(" && ")
@@ -559,6 +595,30 @@ function pathsOverlap(left: string, right: string): boolean {
 	return isSameOrInside(left, right) || isSameOrInside(right, left)
 }
 
+/** Validate nested read-only bind targets before taking filesystem snapshots. */
+export function validateReadOnlyMountTargets(readOnlyMounts: Array<{ source: string; target: string }>): string[] {
+	const targets = readOnlyMounts.map(({ target }) => {
+		if (typeof target !== "string" || target.includes("\0") || target.includes("\\") || /[\r\n]/.test(target)) {
+			throw new Error(`OpenShell read-only mount target is unsafe: ${String(target)}`)
+		}
+		const normalized = path.posix.normalize(target)
+		if (target === "/" || !target.startsWith(`${OPENSHELL_WORKSPACE_TARGET}/`) || normalized !== target || target.slice(1).split("/").some((part) => part === ".." || part === "." || part === "")) {
+			throw new Error(`OpenShell read-only mount target must be a normalized non-root path beneath ${OPENSHELL_WORKSPACE_TARGET}: ${target}`)
+		}
+		return normalized
+	})
+	for (let left = 0; left < targets.length; left += 1) {
+		for (let right = left + 1; right < targets.length; right += 1) {
+			const a = targets[left]!
+			const b = targets[right]!
+			if (a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`)) {
+				throw new Error(`OpenShell read-only mount targets overlap: ${a} and ${b}`)
+			}
+		}
+	}
+	return targets
+}
+
 function isSameOrInside(parent: string, child: string): boolean {
 	const relative = path.relative(path.resolve(parent), path.resolve(child))
 	return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative))

package/src/llm/ollama.ts

@@ -87,6 +87,14 @@ function envThinkEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
 	return v !== undefined && v !== "" && v !== "0" && v.toLowerCase() !== "false"
 }
 
+function isOpenShellHost(baseUrl: string): boolean {
+	try {
+		return new URL(baseUrl).hostname === "host.openshell.internal"
+	} catch {
+		return false
+	}
+}
+
 export class OllamaClient implements LlmClient {
 	private readonly baseUrl: string
 	private readonly defaultModel: string
@@ -108,26 +116,21 @@ export class OllamaClient implements LlmClient {
 	 * real prefill+generation call against a 9B local model at deep prompt
 	 * lengths can legitimately take longer than undici's default assumes.
 	 *
-	 * Overriding this requires a per-instance `Agent` with both timeouts
-	 * derived from `this.timeoutMs` (comfortable margin above it) — but
-	 * passing an `Agent` built from the standalone `undici` npm package as
-	 * Node's GLOBAL `fetch`'s `dispatcher` does not reliably work: verified
-	 * live, this threw `InvalidArgumentError: invalid onRequestStart
-	 * method` (code UND_ERR_INVALID_ARG) — Node's global fetch runs on its
-	 * OWN internal, bundled copy of undici (`node:internal/deps/undici`),
-	 * whose Dispatcher/Handler interface isn't guaranteed to match whatever
-	 * version the standalone package resolves to. The fix is to use
-	 * undici's own `fetch` (imported below as `undiciFetch`) together with
-	 * its own `Agent`, so both come from the SAME package/version and the
-	 * interface always matches — never Node's global `fetch` plus an
-	 * externally-built dispatcher.
+	 * For direct localhost and remote daemon endpoints, use the standalone
+	 * undici fetch and a matching Agent so these timeouts are configurable.
+	 * OpenShell's host relay must use Node's global fetch: a standalone undici
+	 * Agent bypasses OpenShell's transparent network path and the relay closes
+	 * the connection for larger chat requests. The OpenShell worker has an
+	 * outer command timeout, while global fetch retains its conservative
+	 * built-in header/body timeouts.
 	 */
-	private readonly dispatcher: Agent
+	private readonly dispatcher?: Agent
 
 	constructor(options: OllamaClientOptions = {}) {
 		this.baseUrl = (options.baseUrl ?? process.env[OLLAMA_URL_ENV] ?? DEFAULT_OLLAMA_URL).replace(/\/+$/, "")
 		this.defaultModel = options.defaultModel ?? ""
 		this.timeoutMs = options.timeoutMs ?? DEFAULT_OLLAMA_TIMEOUT_MS
+		const usesOpenShellHost = isOpenShellHost(this.baseUrl)
 		// Default to undici's OWN fetch, not Node's global one — see
 		// `dispatcher`'s doc comment for why: only undici's own fetch is
 		// guaranteed interface-compatible with an Agent built from the same
@@ -135,13 +138,16 @@ export class OllamaClient implements LlmClient {
 		// (structurally close enough for test fakes to satisfy); the cast
 		// here just reconciles undici's own Response/RequestInit types
 		// against the DOM-lib ones the public field declares.
-		const defaultFetchImpl: unknown = (url: unknown, init: unknown) =>
-			undiciFetch(url as Parameters<typeof undiciFetch>[0], init as Parameters<typeof undiciFetch>[1])
+		const defaultFetchImpl: unknown = usesOpenShellHost
+			? globalThis.fetch
+			: (url: unknown, init: unknown) => undiciFetch(url as Parameters<typeof undiciFetch>[0], init as Parameters<typeof undiciFetch>[1])
 		this.fetchImpl = options.fetchImpl ?? (defaultFetchImpl as typeof fetch)
 		this.think = options.think ?? envThinkEnabled()
 		this.nodeId = options.nodeId ?? randomUUID()
-		const undiciTimeoutMs = this.timeoutMs + 60_000
-		this.dispatcher = new Agent({ headersTimeout: undiciTimeoutMs, bodyTimeout: undiciTimeoutMs })
+		if (!usesOpenShellHost) {
+			const undiciTimeoutMs = this.timeoutMs + 60_000
+			this.dispatcher = new Agent({ headersTimeout: undiciTimeoutMs, bodyTimeout: undiciTimeoutMs })
+		}
 	}
 
 	resolveModel(requestModel?: string): string {
@@ -173,7 +179,7 @@ export class OllamaClient implements LlmClient {
 				// against the DOM-lib `RequestInit` type this call site is
 				// statically typed against. A fake fetchImpl injected in
 				// tests simply ignores this extra field.
-				dispatcher: this.dispatcher as unknown as RequestInit["dispatcher"],
+				...(this.dispatcher ? { dispatcher: this.dispatcher as unknown as RequestInit["dispatcher"] } : {}),
 				body: JSON.stringify({
 					model,
 					node_id: this.nodeId,

package/src/project-store.ts

@@ -99,7 +99,10 @@ export function resolveProjectIdentity(workspaceRoot: string): ProjectIdentity {
 	// expose host repository metadata. Preserve the original project's store key
 	// without mounting or reading the original repository path in the sandbox.
 	const identityRoot = process.env.HEADLESSCODE_PROJECT_IDENTITY_ROOT?.trim()
-	if (identityRoot && path.isAbsolute(identityRoot)) return { keySource: path.resolve(identityRoot), kind: "git" }
+	const targetRepo = process.env.TARGET_REPO?.trim()
+	if (identityRoot && path.isAbsolute(identityRoot) && targetRepo && root === path.resolve(targetRepo)) {
+		return { keySource: path.resolve(identityRoot), kind: "git" }
+	}
 	// Sandboxed workers may set these to a private Git directory so ordinary
 	// commits cannot touch shared host metadata. Project identity must still
 	// resolve through the workspace's real .git pointer and shared common dir.

package/src/rsi/adaptive.ts

@@ -0,0 +1,49 @@
+import type { AdaptiveSearchDecision, CandidateRecord, RsiConfig } from "./types.js"
+
+/** Decide whether a bounded adaptive run should allocate one follow-up trajectory. */
+export function decideAdaptiveContinuation(input: {
+	generation: number
+	generationCandidates: CandidateRecord[]
+	allCandidates: CandidateRecord[]
+	config: RsiConfig
+	elapsedMs: number
+	decidedAt: string
+}): AdaptiveSearchDecision {
+	const { generation, generationCandidates, allCandidates, config, elapsedMs, decidedAt } = input
+	const maxTrajectories = config.maxTrajectories ?? config.population + 1
+	const maxIterations = config.maxTotalIterations ?? maxTrajectories * config.maxIterations
+	const allocatedTrajectories = allCandidates.length
+	const allocatedIterations = allocatedTrajectories * config.maxIterations
+	const evidence = generationCandidates.map((candidate) => ({
+		candidateId: candidate.id,
+		status: candidate.status,
+		...(candidate.fitness
+			? { visiblePassRate: candidate.fitness.metrics.generalization }
+			: {}),
+	}))
+	const distinctResults = new Set(evidence.map((entry) => `${entry.status}:${entry.visiblePassRate ?? "unknown"}`))
+	const mixed = evidence.length >= 2 && distinctResults.size > 1
+	let reason: AdaptiveSearchDecision["reason"]
+	if (allocatedTrajectories >= maxTrajectories) reason = "trajectory-cap"
+	else if (allocatedIterations + config.maxIterations > maxIterations) reason = "iteration-cap"
+	else if (elapsedMs >= (config.maxRuntimeMs ?? 60 * 60_000)) reason = "runtime-cap"
+	else if (generation >= config.generations) reason = "generation-cap"
+	else if (evidence.length < 2) reason = "insufficient-results"
+	else if (!mixed) reason = "consistent-evidence"
+	else reason = "mixed-evidence"
+	const remainingTrajectories = Math.max(0, maxTrajectories - allocatedTrajectories)
+	const remainingIterations = Math.max(0, maxIterations - allocatedIterations)
+	return {
+		generation,
+		decision: reason === "mixed-evidence" ? "continue" : "stop",
+		reason,
+		candidateIds: generationCandidates.map((candidate) => candidate.id),
+		evidence,
+		allocatedTrajectories,
+		remainingTrajectories,
+		allocatedIterations,
+		remainingIterations,
+		elapsedMs,
+		decidedAt,
+	}
+}